Hacker News Reader

Comment by quuquuquu | Hacker News Reader

Yikes. Ok, let's abstract the topic to debate it.

Dropbox scans user accounts. It alerts the police that objectionable material appears on an account.

The police attempt to associate the account with a person. Social media profiles and IP adresses turn up a name and general geographic location.

Police find a person's name associated with said profiles, email, and IP.

They show up at his address, and ask him, hey, are these accounts yours?

"Maybe, why?"

The police then execute a warrant, confiscate his phone.

The phone contains an app, which is logged into an account with objectionable material on it.

You are now charged with possession of child porn.

Child porn is a terrible and heinous crime. Put that aside for a moment.

What happens if someone illegally accessed your account and placed those images there?

View on HN

That objection applies to almost any possible evidence gathering technique. Framing someone has always been a possibility. It's the subject of many stories, and more than a few real life cases. But we don't know or (IMO) have reason to believe it's become more common in the digital age. You need motive and ability to do it still, and those often don't come together.

The duty of law is to prove guilt "beyond a reasonable doubt".

Is it unreasonable for my account to have been hacked and used to hold illegal material?

There are accounts of mine that I don't even remember existing.

Multiple use multiple devices of mine from time to time.

Should my dad be hauled to prison when I use his computer, and I catch a virus that stores child porn in his dropbox account from 5 years ago?

Getting charged with a crime is definitely not nothing, and the age of automation brings with it new kinds of problems (or at least, ones of different scale). But as the prior comment points out, the possibility of getting framed applies to virtually every other kind of evidentiary process. Such as eye-witness testimony, which is why (ideally), you aren't convicted based on that evidence alone.

If it's the case that someone illegally accessed your account and stored child porn on it, there would presumably be evidence to show that illegal access, such as IP addresses that you don't use that were used to upload that porn.

I do mostly agree with you. What if someone roots my machine and uploads from my house?

What if it was (somehow) accidentally uploaded byy little brother who torrents?

Technical evidence, is difficult to associate with meatspace users.

I'm not trying to give criminals potential defenses---

I am trying to prevent people from going to jail for malleable evidence.

If Dropbox logs the IP address used when the files were uploaded, and the ISP can verify that the IP was assigned to the user's home when the files were uploaded, I'd think that gives more weight.

There's still the possibility that some malware on the user's laptop uploaded the files and then deleted itself, but if that were a reasonable excuse, you could use that to get out of basically any computer-related crime.

I think some grandmas were invaded by a SWAT team because someone used their wifi to seed copyrighted material.

And a grandma in texas has been served thousands of warrants due to her address being closest to the geographical center of the US in Kansas, where IPs default to on a map.

> Is it unreasonable for my account to have been hacked and used to hold illegal material?

I wouldn't necessarily say unreasonable. Incredibly unlikely, though.

How unlikely is that, though?

The question is whether there could be reasonable doubt that, given there is CP on an account, it was put there by the account owner.

What we don't know is what proportion of Dropbox accounts that contain CP had that CP planted by a hacker. If a significant enough proportion of CP on Dropbox was not put there by the account owner, it's reasonable to at least consider the possibility.

It doesn't have to be an attempt to frame the account owner: somebody who wants to exchange CP with other people might well use a hacked Dropbox account to do that, in an attempt to cloak their identities.

What has changed in the last few decades is the possibility of framing someone with little personal risk to the framer.

> What happens if someone illegally accessed your account and placed those images there?

You'll go to jail, and have to figure out how to post a $100,000 bail right then or stay there for quite some time, sometimes indefinitely (see current Riker's Island cases in NYC), you'll have to figure out how to find a good lawyer who maintains a reputation AND won't take the state's charge and media smearing at face value, and also pay their retainer.

Your lawyer will have hoped you actually didn't say "Maybe, why?"

Why do you ask, were you expecting some enlightening thought exercise on changing the process? This happens everyday in this country.

I'm afraid I am right there on the same page as you. I have a hunch many readers are consciously, or unconsciously, ignorant to the problems you described above.

I suspect that you should feel some of these things should change.

Perhaps a lower bail? Perhaps house arrest instead of jail? Perhaps a less costly legal process that vehemently screens for reasons to not go to trial in non-violent crimes? (child porn possession is debatably non-violent).

How do we increase the possibility of bringing about these changes?

> Perhaps a less costly legal process that vehemently screens for reasons to not go to trial in non-violent crimes?

If you can't do any of the things I mentioned above, you will take the plea deal and there will be no trial, you will go to prison for at least several years, possibly decades, but either way you'll be a felon and unemployable for the rest of your life, also a sex offender for the rest of your life, and not for one of those debatable reasons either. But thanks for keeping the process quick, that was very considerate.

But change? Good question. Something broad that isn't about the topic and laws at hand, perhaps leaning on another country's system while being sensitive of our punishment culture. Yeah, I've got nothing, rehab perhaps? I do have to commend you for trying here, and I do hope less people are ignorant to the user experience problems in our justice system.

There have been cases where someone getting busted at airport because one of his wechat groups have images of potentially underage girls someone else posted from a country where that is legal.

God that is torturous to think about.

Once again proves that "don't go to the US" is a viable legal strategy.

We keep commercially sensitive documents on Dropbox yet have to keep nearly all of those documents encrypted locally. If someone broke into our network they'd have a very hard time opening any of them, yet it seems Dropbox could just jump in and read them. Not sure how Dropbox got approved as secure?

You are fooling yourself securing your own network, while open a huge back door to Dropbox. Dropbox is not secure by design. They choose not to do end-to-end encryption, so that they can actively read your files.

No let's not put that aside for a moment. That isn't a reason for not doing this. Obviously no evidence would not be taken alone and it would not come from your ip address if it does then you have some explaining to do - and quite rightly so. Where rights are concerned there is a hierarchy.

I assume that Dropbox knows where and how you access their service... TFA said there was a single IP. If there were multiple then there would be reason to doubt that you were in the sole possession of those files.

>What happens if someone illegally accessed your account and placed those images there?

Depends who planted them...

How will they know? It could be a virus, or someone desiring to frame me, or someone who did it inadvertantly.

Reply on news.ycombinator.com