Google ordered to identify who watched certain YouTube videos

https://www.forbes.com/sites/thomasbrewster/2024/03/22/feds-ordered-google-to-unmask-certain-youtube-users-critics-say-its-terrifying/

by wut42 • 2 years ago

552 357 2 years ago

forbes.com

decremental2• 2 years ago

Someone post the pirate link so we can read this.

goles• 2 years ago

https://archive.is/kAXQ1

mschuster91• 2 years ago

“This is the latest chapter in a disturbing trend where we see government agencies increasingly transforming search warrants into digital dragnets. It’s unconstitutional, it’s terrifying and it’s happening every day,” said Albert Fox-Cahn, executive director at the Surveillance Technology Oversight Project.

If companies would respect the spirit behind GDPR and not store data that is not needed to fulfill a user's requests and protect the data that they must have in a way that makes dragnet searches impossible, this would not be a problem.

Instead, we have sites not being ashamed in informing you about literally thousands of external ad broker, tracking, notifications and whatnotelse integrations.

To u/decremental: you seem to be shadowbanned, here's an Archive link: https://archive.ph/kAXQ1

pvg3• 2 years ago

They are just banned https://news.ycombinator.com/item?id=35995962

pierat• 2 years ago

One in the same on HN.

j33zusjuice• 2 years ago

How is a banned account making visible comments? Also, how did you find that post?

wging• 2 years ago

The comment in question appears in incognito mode. I don't think they're banned.

decremental2• 2 years ago

That's true, I'm just banned but it still lets me comment and that's fine with me. No pesky fake internet points to worry about.

loeg3• 2 years ago

If companies would respect the spirit behind GDPR and not store data that is not needed to fulfill a user's requests and protect the data that they must have in a way that makes dragnet searches impossible, this would not be a problem.

Saving user watch history is useful for users. Sure, make it optional, but I find it really useful that youtube shows me if I've already watched a video, and that I can find recently seen videos in my watch history.

boppo1• 2 years ago

There should really be levels of history. I don't want youtube keeping every video I've ever watched on file, so I have history off. However, now, if I leave a video and come back to it the next day, my place in the video is lost. Lemme specify the length of time to keep history pls.

nonethewiser2• 2 years ago

That doesn’t require them to know who you are.

dpkirchner• 2 years ago

I'd prefer to have that sort of thing stored locally, perhaps synced between all of my browsers/computers (directly, without storing the history unencrypted on servers).

alisonatwork• 2 years ago

Any client software can do this for the users who want it. There is no need for the service provider to track user watch history on the server by default.

throwaway237289• 2 years ago

If companies would respect the spirit behind GDPR and not store data that is not needed to fulfill a user's requests and protect the data that they must have in a way that makes dragnet searches impossible, this would not be a problem.

This is ridiculous. Literally the authorities are the one demanding information, so that they can abuse that power.

And you're blaming the people with information?

Stop fighting the wrong war: hold the people with power accountable. That's the government here. They can use force and put you in jail. That's power.

tomrod• 2 years ago

Both, not either.

kevinmchugh• 2 years ago

Anyone collecting data needs to consider how the data can be misused. Whether that be by a (repressive) government, a hacker, or a future purchaser of the data

aprilthird2021• 2 years ago

With the TikTok ban, jawboning, and now this, it feels like the US really wants to control the narrative its citizens see, now much more than previously...

Clubber• 2 years ago

the US really wants to control the narrative its citizens see

They had control for decades, then traditional television/cable media started to collapse. They're trying to take control of "new media," in the internet.

falsaberN12• 2 years ago

TikTok has a narrative? I thought it was all about cooking recipes that may or may not destroy you if you make them as instructed.

mardifoufs2• 2 years ago

Yes. It totally switched the narrative on Israel (and that's great imo). They didn't ban videos of Palestinians getting murdered and bombed, like other platforms did. It's a bit insane since even my apolitical friends got exposed to the raw videos and now it really shaped their opinion. I won't push it since I know this never actually happens, but it got zoomers to maybe even consider the conflict important enough to be an issue that swings their vote (the issue is that we don't vote lol).

For me that's awesome. But it really really really didn't sit well with members of Congress I guess, and boomers in general.

FpUser2• 2 years ago

"...undercover agents sent links of YouTube tutorials for mapping via drones and augmented reality software, then asked Google for information on who had viewed the videos, which collectively have been watched over 30,000 times."

For fuck's sake, there are thousands upon thousands of companies and individuals with totally legit commercial interest in this tech. I bet Zwift and the likes are doing just that.

anamax3• 2 years ago

undercover agents sent links of YouTube tutorials for mapping via drones and augmented reality software, then asked

Entrapment?

koolba• 2 years ago

I read that as “they sent a list of URLs”. Not, “they uploaded a bunch of videos”.

FpUser2• 2 years ago

Entrapment is a practice in which a law enforcement agent or an agent of the state induces a person to commit a "crime" that the person would have otherwise been unlikely or unwilling to commit.

Viewing the links and using technology covered by those is anything but. This is trying to make crime suspects out of thin air. So much for fucking free democratic society.

initplus3• 2 years ago

Entrapment isn’t just “any time police trick you during an investigation”. It is only entrapment if the police actually induce you to commit the crime you are charged with. Viewing these videos is not a crime.

squeaky-clean• 2 years ago

I didn't take it that those videos were illegal. But they tried to trick the criminal into watching some videos with low view counts that they would be interested in, and then planned to ask youtube who viewed all of those videos during that time.

Like an ip gathering honeypot website. Except they probably assumed the criminal would be too smart to click a link to some random website. But they would visit some youtube links. And then they knew Google would roll over and give them the info of all viewers.

It's a scummy plan, but mostly because Google will give away that info without putting up any fight.

declan_roberts• 2 years ago

We learned from Nest that they won't even require a warrant before handing over the code to a smart lock to law enforcement.

No judge needed. Just ask and say "open sesame"

crooked-v• 2 years ago

"Mapping via drones" is from what I understand the #2 income source for professional drone operators, right after visual or IR maintenance surveys of industrial building exteriors.

patrickmay• 2 years ago

They should have just paid for targeted ads on those videos. It wouldn't take many to narrow the pool.

randomdev3• 2 years ago

If doing shady shit, you're not using your own IP, let alone Google account...

colechristensen• 2 years ago

You overestimate the average kind of person doing shady shit.

addicted• 2 years ago

There are different incidents here.

The first one where the police uploaded videos and wanted viewer information is absolutely egregious and makes me wonder how a court could authorize that.

The next one, which I didn’t fully understand, but appeared to be in response to a swatting incident where the culprit is believed to have watched a specific camera livestream and the police provided a lot of narrowing details (time period, certain other characteristics, etc) appears far more legitimate.

godelski29• 2 years ago

I don't understand how either of these are remotely constitutional. They sure aren't what is in the spirit.

They asked for information about a video watched 30k times. Supposing every person watched that video 10 times AND supposing the target was one of the viewers (it really isn't clear that this is true), that's 2999 people who have had their rights violated to search for one. I believe Blackstone has something to say about this[0]. Literally 30x Blackstone's ratio, who heavily influenced the founding fathers.

I don't think any of this appears legitimate.

Edit: Ops [0] https://en.wikipedia.org/wiki/Blackstone%27s_ratio

changoplatanero• 2 years ago

The second one seems a lot more narrow and more legitimate

mingus88• 2 years ago

Cell phone tower data has been used for a decade now in pretty much the same way.

Did you happen to pass by a cell tower in a major city around the time a crime was committed? We all have.

Well, your IEMI was included in a cell tower dump. Probably dozens of times.

Did you happen to drive your car over any bridge in the Bay Area lately? Did a municipal vehicle pass you and catch your license plate with their ALPR camera?

Guess what? Your name went through a database of an LEO search if they wanted to find a perp for that time/location.

Privacy has been dead for a long time. The worst part is people don’t care.

The Snowden files changed nothing. If there was ever a point in history where people would have given up their cell phones for their civil liberties, that would have been the time to do it.

vages• 2 years ago

Did you forget the link to Blackstone?

CobrastanJorji2• 2 years ago

I agree that it's egregious, but Sir Blackstone was talking about punishment, especially relating to execution, and I think perhaps the ratio can be adjusted significantly downward when the cost to the innocent is much lower. Otherwise, the only reasonable search would be when a government official is already certain of your guilt.

jameshart5• 2 years ago

Blackstone: "It is better that ten guilty persons escape than that one innocent suffer"

So not sure where you got the impression he's okay with up to 100 people being disturbed so we can catch one bad guy.

But then, he wasn't really talking about that was he? Better the guilty go free than the innocent suffer what? He was, essentially, talking about the principle of innocent until proven guilty; that innocent people shouldn't suffer by being punished for a crime unjustly.

2999 innocent people, in your formulation, though, are not being punished for a crime. They're not even being accused of a crime.

naasking• 2 years ago

Supposing every person watched that video 10 times AND supposing the target was one of the viewers (it really isn't clear that this is true), that's 2999 people who have had their rights violated to search for one

I think whether their rights are violated depends entirely on what sort of information is handed over. Consider acquiring surveillance footage that has plenty of foot traffic, but a suspect is known to have passed by. The police are typically permitted to review that footage even though plenty of innocent people were captured on that video.

okr2• 2 years ago

If it is an order by a court, then i think it is ok. Then it is no mass surveillance and for solving a crime it is useful.

I wonder what kind of video it is. Maybe a shared link, so only people who secretly know about it knew about it, and they have become suspects. Is it mentioned in the forbes article?

And i wonder if people abuse videos on youtube by encrypting the content with a key and the key is then shared.

iteygib• 2 years ago

Any kind of search can be deemed constitutional if it goes through a warrant process, which is the point of warrants. This story is less about the how the information was taken and more about whether or not the warrant process and 4th Amendment rights were properly followed.

This would then be mixed in with the question of whether or not new forms of data (like video views) would equate to previous forms of similar data searches that police have obtained warrants for (like reviewing CCTV).

lolinder• 2 years ago

OP explicitly agrees with you that the 30k is illegitimate, but that's the only one you address. What's your take on the one where the police became aware that they were being watched on a YouTube livestream while responding to a bomb threat and obtained a court order asking for information about who was viewing a set of local livestreams at the specific times where they were searching for the bomb?

What makes that one different than a court order demanding that a business release security footage that covers the scene of a crime for the time window in which the crime occurred? Or would you consider such a court order to also be illegitimate?

mistermann2• 2 years ago

I don't think any of this appears legitimate.

It isn't.

Democracy is fake.

Our justice system is fake.

Everything is fake.

(Where "fake" = "not what they are advertised or perceived to be.)

If all of the same things were occurring in another country, or even better: in a video game, you would have little difficulty and zero aversion to accepting these facts.

However: put a person into these things, and the brain malfunctions.

If you are a reasonably normal person, your mind will now be filled with objections to this proposition, reasons why I am incorrect. But if you were to state those objections, I can punch holes in every single one of them without even breaking a sweat.

We live in a literal simulation, but not the kind that everyone has been hypnotized to believe is the only kind possible - have you ever noticed that when the notion of simulation theory comes up, it is always The simulation theory (Nick Bostrom's)?

This is a pretty neat trick eh? And there seems to be nothing that can be done about it, because people will fight tooth and nail (using Meme Magic, aka "The Facts", "The Reality", etc) against being extracted.

Thankfully, it is simultaneously hilarious. Well, except the part where millions of children are dying, but nobody cares....but oh boy when a big scary "pandemic" comes along, pull out all the stops.

I hope that there is a Hell, because I would like to see every single member of this despicable 21st century society end up there some day. Seeing justice finally being served for once would be worth suffering for eternity.

singleshot_• 2 years ago

Better one person not be crushed to death than two thousand nine hundred ninety nine suffer essentially no harm whatsoever.

No, that doesn’t seem very familiar.

ChuckMcM• 2 years ago

I certainly concur with this.

On the one hand, a narrow warrant that reveals a lot of people (classic example are warrants on motels to provide the names of everyone who checked in on a certain date, or was registered on a certain date) are certainly constitutional and have been upheld many times.

The first seems, odd.

initplus3• 2 years ago

The first is a somewhat clever attempt to unmask someone ann undercover investigator was already talking to. Police should have narrowed scope of the warrant by only asking for data on viewers within a narrow window after they sent the link.

Even better might have been to directly link to some service that they already control on a honeypot URL, and then gone after the ISP for customer details.

godelski29• 2 years ago

  In a just-unsealed case from Kentucky reviewed by Forbes, undercover cops sought to identify the individual behind the online moniker “elonmuskwhm,” who they suspect of selling bitcoin for cash, potentially running afoul of money laundering laws and rules around unlicensed money transmitting.

  In conversations with the user in early January, undercover agents sent links of YouTube tutorials for mapping via drones and augmented reality software, then asked Google for information on who had viewed the videos, which collectively have been watched over 30,000 times.

This is the first case. This doesn't seem that narrow to me.

phire2• 2 years ago

The first one where the police uploaded videos and wanted viewer information is absolutely egregious and makes me wonder how a court could authorize that.

The police didn't upload they videos. It's not entrapment, and it doesn't sound like the actual content of the videos is illegal.

Instead, they had an open communication channel with their target and were able to send them various links to youtube videos.

Their theory being if they can find any user who clicked on all (or most of) those links, it's probably their target. And it's unlikely some random user would have accidentally viewed all those videos.

The actual request for the raw list of all viewers seems unconstitutional to me. Too broad, gives the police a lot of infomation about all users who watched just one of the videos. But I suspect a much narrower request where google identified the target user and past just that user's info on would be constitutional.

csomar• 2 years ago

But I suspect a much narrower request where google identified the target user and past just that user's info on would be constitutional.

Isn't that worse? Essentially making Google do the job of the police and the police having to trust the work of Google for it.

supposemaybe• 2 years ago

If you see a YT which is remotely dodgy, don’t watch it… It very well could be planted there as bait.

And that’s great Google are trying to fight back, a little. Though I wonder that for us Non-American Brits that they’d do the same for us too (doubtful)

helpmefindpurp• 2 years ago

A person from rdrama managed to find the FBI victim's anon reddit profile (public information), and apparently it was IRS evasion? https://rdrama.net/h/slackernews/post/255754/google-ordered-...

nonethewiser2• 2 years ago

Im increasingly coming to the opinion that anonymity isnt guaranteed so you should assume everyone knows what you do.m and who you are. So you should probably just use your real name and do way less online.

Havent fully swallowed this pill but its feeling inevitable.

rapind4• 2 years ago

100%. We probably shouldn’t protest or even discuss non-conforming ideas. Just agree with the current rulers on all things to be safe. Also make sure to vote for the right leaders because who knows how long that’ll remain private.

scubbo• 2 years ago

Not sure if you're being downvoted because people think you're serious, or because they dislike sarcasm.

zeroCalories2• 2 years ago

You won't dare post anything actually transgressive.

naruhodo• 2 years ago

Because of the possibility that the leaders will change - or change their opinions - in the future, the only safe course of action is to express no opinion whatsoever.

Brian_K_White2• 2 years ago

We also, apparently, shouldn't even try to discuss and figure out any other possible approaches or responses to any given problem that might exist.

We don't care if this wall might possibly be easy to simply walk around and obviate, we shouldn't even look, or even talk about looking. The only rational way to attack any problem is to just look exactly in the direction you were led to look, bang your head on that same spot forever.

2OEH8eoCRo02• 2 years ago

Or go back to how things were: Keep it to yourself and discuss spicy topics among close friends. Friends assume good faith. People on the internet tend to assume the worst interpretation possible and don't give any benefit of the doubt.

dogman1445• 2 years ago

I mean do all that but don’t tweet it and leave your phone at home. That is the issue.

Terr_2• 2 years ago

There's a crucial distinction here between the pragmatic and the normative, or else there's a feedback trap where accepting it as normal makes it even more common.

In other words you can plan around the worst case, but don't let go of the opinion/social-value that it's too-common and wrong and aberrant.

jrockway• 2 years ago

I think it's all about how many clues you leave behind. If you make a HN account that you only access via Tor through a browser with Javascript turned off and stick your writing through some AI editing service, it's probably pretty difficult to trace anything back to you. If you stream yourself 16 hours a day every day, your nickname probably isn't saving you from much, as it only takes one person to go "oh I know them" and then your secret's out. So like everything, it's about a striking a balance. Who is out to get you, and how much do you like doing things online? Just a question you can ask yourself before you move into a cabin in the woods and work on your novel 24/7 or whatever. (Publish it under a pen name, though, obviously.)

bas• 2 years ago

Consider: if your adversary is the NSA, CIA, or (maybe) FBI, you’ve already lost the game you’re playing.

godelski29• 2 years ago

If you make a HN account that you only access via Tor through a browser with Javascript turned off and stick your writing through some AI editing service, it's probably pretty difficult to trace anything back to you.

This is already too hard. But anything that can be done needs to be wrapped up into a trivial to use interface. It has to be for everyone, not just people who are technologically {capable,knowledgeable} and have the time and energy to do this all the time every time. It needs to be standard.

Of course, we should fight this from both ends. Many ends. We shouldn't collect the data. We shouldn't process it. And we should build defenses.

afro88• 2 years ago

But by doing this (Tor etc), you've also potentially identified yourself as a person of interest who warrants further scrutiny. It begs the question: what are you trying to hide.

bdw52043• 2 years ago

If you're looking for privacy from your current and possibly future employers, you can obtain that by using a pseudonym online and taking basic measures to make yourself hard to dox. If you want privacy from the US government, that's not going to work.

Also, getting doxxed isn't entirely bad because it can open doors as well as closing them. Depends on how you leverage it. You just don't want the US government and/or the government where you live as your adversary.

AdamJacobMuller• 2 years ago

you should probably just use your real name

Nonsense.

JKCalhoun3• 2 years ago

Ha ha.

godelski29• 2 years ago

We're on a tech forum known to have some of the best and brightest and visited by tech giants. If anyone can solve this problem, it is us. If we are the ones giving up, then who is there to make things right?

As I see it, our only choice is to make privacy and anonymity trivial. Not for techies, but for our tech illiterate grandparents. Push hard for tools like Signal where people can get encryption without having to think about encryption. People want privacy and security but they just don't know how or don't understand what leaks data. But there's the clear irony that the sector __we__ are critical to is the one who is creating this problem.

I'm not ready to swallow that pill. I'm unconvinced we have to. Clearly __we__ can do something about this. Even if that is refusing to build such things, let alone build defenses. Apathy is no different than supporting these authoritarian takeover, because that's what it is. Authoritarian creep.

zeroCalories2• 2 years ago

Solving these issues won't make you much money, and anyone that gets close will invite more heat than the center of the sun. Better to divest. Keep an email and phone for essential services like banking but avoid all other activity.

bdw52043• 2 years ago

Any truly reliable privacy and anonymity tool that isn't created by the government will probably be made illegal by the government. Failing that, using it will make you a target of the government's security apparatus. If you create a cryptocurrency that can't be traced[0] or an anonymous marketplace where people can buy and sell anything they want[1], you're going to end up on the wrong end of US government trade sanctions or US drug laws. Running a Tor exit node gets your IP address blocked by much of the internet and can even get you a visit from the FBI[2]. Tor itself only exists because it was created by the US Navy as a tool for dissidents in dictatorships to be able to access the internet.

The only way to solve the problem would be to elect politicians who would either dismantle most of the surveillance system or address crime and terrorism so decisively that there was no longer any plausible threat to justify continuing to maintain a mass surveillance apparatus in which case it would (hopefully) eventually wither away as part of budget cuts once politicians forget why it was even "necessary" in the first place. There is no solution to political problems without obtaining and using political power to solve them.

The strategy of eliminating the system's justification isn't foolproof though because the bureaucracy that runs the military draft (Selective Service) somehow still exists even though the draft was ended around half a century ago and is almost certainly never coming back. Politicians only noticed it existed a few years ago long enough to debate whether to extend the wrong of registration for it to include women in addition to men. The eventual decision was to leave the status quo intact[3]. The sensible option of abolishing that relic of a past rights violation rather than continuing to waste money on maintaining the bureaucracy was not seriously considered. That means the direct route is almost certainly the better approach.

[0] https://www.theregister.com/2022/08/10/github_tornado_cookie...

[1] https://en.wikipedia.org/wiki/Silk_Road_(marketplace)

[2] https://www.reddit.com/r/TOR/comments/rjgq8s/ok_so_what_has_...

[3] https://www.politico.com/news/2021/12/06/ndaa-women-draft-dr...

tredre32• 2 years ago

    If anyone can solve this problem, it is us.

People on this forum (including myself) are the ones creating the tools that enabled this problem.

Any tech we create to "solve" this issue will be worked around and/or used to cause more problems.

Tech isn't the solution.

andsoitis5• 2 years ago

We're on a tech forum known to have some of the best and brightest and visited by tech giants. If anyone can solve this problem, it is us. If we are the ones giving up, then who is there to make things right?

You think the world’s geniuses are hanging out here? The world’s brightest are here and you’re going to inspire them to solve what you frame should be a very high priority? There are much bigger problems to solve.

I really think your vanity is warping your perspective.

ejb9992• 2 years ago

"It is difficult to get a man to understand something when his salary depends upon his not understanding it." -- Upton Sinclair

I have no hope that the people who created the very tools that led to these problems, are in anyway going to try and solve this problem.

Nextgrid4• 2 years ago

If anyone can solve this problem, it is us

We've literally created this problem by making industrial-scale stalking profitable and socially-acceptable. We've created an entire self-sustaining industry that spies on everyone, is not accountable and that the government can just ask for data when needed.

2OEH8eoCRo02• 2 years ago

best and brightest and visited by tech giants. If anyone can solve this problem, it is us.

I'd say this egotistical god-complex is exactly what got us into the current mess.

JKCalhoun3• 2 years ago

I more or less do that. Not really related to privacy, but I find that if I post as myself, I am more honest, less likely to troll, more considerate of others when I post. For me it's healthier.

brikym• 2 years ago

Black mirror is far too accurate and coming true far too soon.

datavirtue2• 2 years ago

Glassdoor is dox'ing people so...

ilrwbwrkhv• 2 years ago

And that's why these social media networks ruined the internet. Companies like Facebook forced "real identities". Now suffer everyone for giving in.

wiseowise• 2 years ago

Yes, agent Smith.

cbolton• 2 years ago

I think that's exactly what Google's ex-CEO said years ago:

If you have something that you don’t want anyone to know, maybe you shouldn’t be doing it in the first place

which you can read either as a terrible "nothing to hide nothing to fear" comment or as a good warning about the factual state of things.

Kim_Bruning• 2 years ago

So one's privacy posture should be part of the complete security posture, and should ideally start at

"DEFAULT DENY ALL"

After which you can -of course- start opening up ports and start trusting people with information. Even if done imperfectly, one's attack surface is at least under some sort of control. I mean -at least- a semblance of control can be taken, however aspirational in practice. It allows conscious control of ones information flows.

As you may have experienced yourself a posture of "DEFAULT ALLOW ALL" is effectively impossible to manage, since tracking down and plugging new leaks faster than they show up is pretty much like bailing out a boat with -well- a squillion leaks (and more every minute).

Getting muggles to a safe default posture is going to be difficult. However, seeing the growing awareness in society it might not be impossible.

Think of nascent privacy initiatives by the EU (no matter how (in)effective as yet). Or you could think of starting school programs akin to "just say no" for instance, promoting more conscious and careful online behavior. It might never be perfect, but some level of herd resilience might be attainable?

fsflover• 2 years ago

This is security nihilism: https://news.ycombinator.com/item?id=27897975

jll293• 2 years ago

What you say is indeed one possible way to deal with it.

Treat it as a public postcard signed with your name, and never for a minute assume that someone doesn't link what you say to your identity.

This mode of operating means you will be more polite when angered by some troll online, as you are not hiding behind some pseudonym.

And at least you won't be shocked when a Website does what Glasdoor recently did, i.e. convert from pseudonyms to people's real names WITHOUT CONSENT OR WARNING. Surely by using always your real name you will not bitch about your employer on a Website when you name is shown as the poster and you will still want to get promoted, or at least retained as an employee.

Too• 2 years ago

So the whole internet will become like LinkedIn. Let the horror begin.

dghughes• 2 years ago

I'm also waiting for the day, which is pretty much here now, when you will have to use a real name for any sign up form on any website. Something verifiable and not John Smith at phone 123 456 7890.

dogman1445• 2 years ago

Talk to anyone in advanced privacy work or out of government -> full stop, yes, if you’re not doing Snowden-style measures (TailsOs) or really reconsidering where and how your phone travels around with you and browser controls, it’s done.

Tracking and the firms that do it is incredibly extensive and hard to beat (ie browser ad you just scroll by can fingerprint you well enough).

bufferoverflow• 2 years ago

What are you talking about? Use VPN outside of US jurisdiction, register a random google account, and use YouTube all you want in almost full anonymity.

Just keep in mind that if you write comments, and you also write under your real name, it's relatively easy to identify you by the writing style.

Eisenstein• 2 years ago

Let's walk through this rationally:

Take the crime they are investigating and ignore that; it is a red herring. Say that there is a stalker who hacked someone's devices and pulled private information and videos from them, and posted them publicly. Something unequivocally bad. We would all agree that there needs to be a way to investigate and stop this person and seek justice for the victims.

Until recently, taking this to the cops would get you a blank stare and nothing would happen. At least now in certain places it is taken seriously. But traditional investigative methods don't work. They would need to get access logs to the places where that data was uploaded, at the very least.

Cops are not particularly great at investigating (most crime is solved by confessions or just catching them in the act). They don't have any reason not to just blindly grab all the data and sort through it by hand, because that's what they know how to do, and if they request it and get denied, why would they care? They either try something else or say 'fuck it'.

Local Judges see a request for records and a block of time and it seems reasonable to get that info. No one is sitting and explaining to them the implications of allowing cops access to personal information from viewer logs. Historically, the lower courts are not the place to seek enlightened rulings.

Google? I honestly have no love for them, and they bend over for China every day for worse stuff, so I would be surprised if they gave two shits about their users, except that if this becomes common enough they might actually have to devote support to these requests, and they hate giving support, so they might fight it just for their own self-interest.

The problem is that there is no settled case law here and no clear legislation, and I would hesitate to take any important cases to the Supreme Court until at least Mr. "Is This a Pube on My Coke Can" is gone.

knightoffaith6• 2 years ago

For those who have not already heard of it, check out invidious: https://invidious.io/

A list of public instances (which you probably want to use if you're concerned about being identified) here: https://docs.invidious.io/instances/

recursive2• 2 years ago

Videos still get served by youtube. Maybe you know something I don't, but I wouldn't assume this is a way to get absolute anonymity against YT.

knightoffaith6• 2 years ago

Well, I don't know if there's any way to be absolutely anonymous on the internet.

It seems to me that there's still good reason to prefer using invidious on an instance used by many people as opposed to youtube directly. Can't make perfect the enemy of the good.

jraph• 2 years ago

There's an option to use Invidious as a proxy, though I don't know if public instances offer this (and you probably need an invidious account).

ycombinatrix• 2 years ago

How do you propose we watch YouTube videos without getting served by YouTube?

Youtube only sees the Invidious instance, not the end-user clients. That's probably as good as it gets.

balls1873• 2 years ago

The order was merely a nicety. I cannot imagine any company succeeding at taking a stand against the United States Federal Government on when it really wants something.

Likely the same with any other major nation state (I bet the chinese govt once showed Google it could at will access all their data, in order to capitulate cooperation, while the US is given full access at any time for any reason)

xethos• 2 years ago

I don't like Apple. I'm cheering on the current lawsuit brought by the feds. I do not, and never have owned, an iPhone, and Apple is not the bastion of privacy they sell themselves as.

That said, credit where it's due: https://en.wikipedia.org/wiki/Apple%E2%80%93FBI_encryption_d...

c0pium3• 2 years ago

What are you basing this on? The US government gets told no about things it really wants literally all the time.

Edit: this is also not the federal government, state and local government has even less juice than the little the Feds possess.

px43• 2 years ago

Eh, no. Are you familiar with MUSCULAR? It was in the Snowden leak. Basically Google kept telling the NSA to fuck off, so the NSA dug a hole and tapped some fiber to exfiltrate clear text communications between data centers, which was apparently a lot of important stuff back then. Within weeks of the MUSCULAR leaks, all Google datacenters were communicating with each other with proper SSL termination.

Are you familiar with Aurora? It was that time in 2009 when a Chinese military unit broke into Google and started poking around for information about some known dissidents. They were expunged quickly and the level at which Google stepped up their security game is unparalleled in the history of infosec.

Yes, the NSA or various law enforcement groups can get information from Google if it goes through the proper channels, and there's probably a handful of intelligence community insiders who hand data out of Google from time to time as well, even as part of various intelligence sharing agreements, but the idea that the NSA just has free access to whatever they want there is ridiculous.

rufus_foreman• 2 years ago

I'm all for freedom and individual rights and all of that. But you also have to look at what is going on here.

This person is suspected of selling Bitcoin for cash.

It says so right in the article:

"undercover cops sought to identify the individual behind the online moniker “elonmuskwhm,” who they suspect of selling bitcoin for cash"

Says it right there.

To anyone who thinks that is acceptable or that there is some sort of overreaction by the authorities, I don't even need three words to refute you. Three numbers is enough:

9-11

politician2• 2 years ago

This person is suspected of selling Bitcoin for cash.

There must be more to it than that; buying and selling Bitcoin isn't illegal.

balls1873• 2 years ago

Per the GP—this is likely about someone laundering money for terrorist organizations that the US is investigating.

roenxi• 2 years ago

Well, in the US in general it might be. The police are saying that it is probably a crime under money laundering and unlicensed money transmitting laws. The issue is that particular set of laws are mostly outrageous and quite unintuitive in practice. They criminalise a lot of quite reasonable activity - in this case, like selling bitcoin for cash.

Although the thread root refutation makes no sense. Freely trading bitcoin leading to 9-11 is going to have to involve some flexible mental gymnastics since 9-11 happened in a pre-Bitcoin world. In practice AML style laws are generally targeting tax evasion.

ejb9992• 2 years ago

Did 9-11 happen because of bitcoin? Not sure I understand your point?

Dibby053• 2 years ago

I'm pretty sure it's satire.

tamimio• 2 years ago

The court orders show the government telling Google to provide the names, addresses, telephone numbers and user activity for all Google account users who accessed the YouTube videos..

Hopefully that clarifies for some folks why these big tech/social media companies insist on having your phone number as a “2FA for security” despite all the sim-swap attacks.. simply for this moment, because you might be using a VPN, and address/name aren’t in your google account, but definitely your phone number is there, it’s even worse if you’re using an android too, as they probably will pull out all your app/browsing history..

chatmasta2• 2 years ago

You can avoid this with Google by using a virtual WebAuthN device (ironically via Chrome devtools), and then you will unlock the ability to enroll in MFA with a QR code for an OTP URL.

getcrunk• 2 years ago

This sounds like it’s new though? And maybe is for testing/dev and will go away?

c0pium3• 2 years ago

Which really underscores that all of the MFA stuff is actually about security. Because of course it is.

crotchfire• 2 years ago

You can't avoid it during account creation.

So they still have the number.

caskstrength• 2 years ago

No, it doesn't "clarify" anything like that. If google doesn't have phone numbers of some subset of the accounts requested... they will just specify so in their response to law enforcement since it is completely legal and google is not currently obligated by law to have phone numbers of all users of Youtube. Sundar isn't going to prison because of that or anything.

Saying that some PM at Google decided decade ago something like "hey guys let's build a database of our user's phone numbers to satisfy some theoretical future dragnet surveillance request from law enforcement and tell our users that it is for their own security" is actually quite ridiculous conspiracy theory if you think about it.

kevincox2• 2 years ago

I'm not saying that there aren't other motives, but there are legitimate security concerns.

Credential stuffing is a huge issue for large providers and requiring 2FA is a huge mitigation. Sure, a targeting attack will make the SIM swap, but that is a huge difficulty upgrade from generic credential stuffing.

dogman1445• 2 years ago

Source - am a fairly experienced security engineer.

It’s a nonsense argument to say Google can’t handle credential stuffing without SMS 2FA in place, as in not pushing all 2FA via Google Authenticator and using the very wide reach and talented security team for baseline cred stuffing. Sec tools for this, even without being Google and their very talented sec team, are pretty good.

Wanting a hard phone number is a pure identification play and also about the more likely pragmatic concern (than cred stuffing) of using Google for burner accounts.

IshKebab3• 2 years ago

"Guys, we know our users' names, addresses, all of their emails, browsing history, location history and contacts... but we're missing the critical information! Their phone numbers! Can anyone come up with a security justification for asking for it?"

-Nobody ever.

Come on, use your brain. Even if you are talking about smaller entities who might otherwise only have names and emails, why would they want phone numbers? They don't care about identifying you. And even if they did they already have your email and name.

Step away from the tin foil...

dogman1445• 2 years ago

Brief counter, based on adtech knowledge.

Fingerprinting to a user, especially for a bulk request, without something to anchor on like a device id (or phone number), is harder than you make it out to be. End of third party cookies and so on has had an effect.

Nextgrid4• 2 years ago

why would they want phone numbers

Because it is trivial to make a burner/secondary email address, but much less trivial to do the same with a phone number. Furthermore, everyone adds phone numbers to their contacts but very few add emails, so phone numbers are much more valuable from the perspective of inferring social graphs.

Both of these are extremely valuable for adtech and generic "growth & engagement" scum, thus why all companies matching this criteria started effectively requiring phone numbers. The 2FA/security angle is just an excuse for the true reason behind it.

WillieCubed• 2 years ago

The court orders show the government telling Google to provide the names, addresses, telephone numbers and user activity for all Google account users who accessed the YouTube videos between January 1 and January 8, 2023.

Interesting aside: Viacom used a similar broad request back in 2008 [1] in its lawsuit that nearly put YouTube out of business in its infancy. This time, it's the government making the request, and Google has way more data to potentially provide.

[1] https://web.archive.org/web/20100702111029/http://afp.google...

datavirtue2• 2 years ago

Isn't that what they already do? I feel like I'm taking crazy pills.

Animats• 2 years ago

"In conversations with the user in early January, undercover agents sent links of YouTube tutorials for mapping via drones and augmented reality software, then asked Google for information on who had viewed the videos, which collectively have been watched over 30,000 times."

Huh? Why? Is this because some country doesn't like people having good mapping technology? Israel and China object to precision mapping, but the US historically has not.

templeosenjoyer• 2 years ago

It was likely a fake mutual interest and they hoped "elonmuskwhm" would watch the videos so they could gather some data about them. That's how I interpreted it anyway.

arp242• 2 years ago

Somewhat related story from a few years ago:

Justice Department withdraws FBI subpoena for USA Today records ID'ing readers - https://news.ycombinator.com/item?id=27408647 - Jun 2021 (174 comments)

MilStdJunkie• 2 years ago

Eleven hundred steaming pantloads of hot bullshit. This is textbook fishing trip. The real zinger of all this . . the thing that has me riled . . is that this is going to be used to put away who knows how many poor-ass sadsack innocent citizens who can't afford counsel, before the poooh-leeeeease finally bust that one guy who has the money to afford legal representation. Upon which everyone goes oh right this was really illegal SILLY US

Someone posting up illegal videos? We already got laws for that, you sons of bitches. WATCHING videos? Like, "everyone in the country who watches this video?" Get the hell out of here.

someotherperson• 2 years ago

Casual reminder that Invidious[0] and Piped[1] exist. Farside[2] can automatically redirect you to a working instance, for example: https://farside.link/invidious

If you add a redirector plugin for your browser, you can add a capture for something like this:

  https?://(.*?\.)?youtube.com/(.*)

And push it to something like this:

  https://farside.link/invidious/$2

For example: https://farside.link/invidious/watch?v=Ag1AKIl_2GM

[0] https://github.com/iv-org/invidious

[1] https://github.com/TeamPiped/Piped

[2] https://farside.link/

self_awareness• 2 years ago

1. Upload a video to YouTube, 2. Make it non-public, but possible to view for people who have links, 3. Post it to some shady underground forum full of people who want to do bad things to you for money, 4. Build the net of connections and track people who did watch the non-public link, see who knows who in this degenerate world of extorsions and theft, 5. Send the message to criminals that if they want to continue what they're doing, then even YouTube isn't safe for them, 6. Profit.

TBH, if the above would be true, I would even be happy. But I'm biased, because I sincerely hate thieves and extorsionists.

Bu9818• 2 years ago

Use Invidious, use RSS, use yt-dlp, use Tor.

HeartStrings• 2 years ago

Why are you linking to paywalled scam sites?

Razengan• 2 years ago

All this surveillance and cops still can't catch day to day petty thieves and scammers.

tacocataco3• 2 years ago

This stuff is meant to control the working class, not help them.

Working as intended.

phkahler• 2 years ago

Why can't the police track down someone who calls in a threat from the phone records? How can people be more anonymous with "caller ID" than YouTube?

stainablesteel• 2 years ago

its eerily similar to the federal government forcing elon to give every piece of data on every person who ever liked a trump tweet

the water is already boiling, its time to jump out

maxlin• 2 years ago

https://archive.is/2fCUs

(Never not seen an archive link of a paywalled article buried so carrying my part of that responsibility)

atlgator• 2 years ago

Just waiting to get pinched for my secret shame: bourbon hunting videos.

I don't even drink bourbon.

password4321• 2 years ago

Police sweep Google searches to find suspects; facing its first legal challenge

2022-06-30 https://news.ycombinator.com/item?id=31938350

Google ordered to identify who watched certain YouTube videos

Related Stories