Child abuse images hidden in crypto-currency block chain
bbc.com
bbc.com
If someone does this in a way that goes unnoticed, and it's discovered after long enough that rolling back is impractical, does that effectively kill the blockchain where the data is embedded, at least as far as the US and countries with similar laws are concerned?
[1] https://www.justice.gov/criminal-ceos/citizens-guide-us-fede...
What's the smallest piece of data that qualifies?
Can a 16x16 image be illegal?
What about a 64x64 image?
What's the situation like if you have two chunks of data (perhaps at two separate locations on the blockchain) and only if you XOR them you get the illegal image?
That's an interesting legal question and there's also already a content publishing system (Publius) that afaik uses a similar approach: https://en.wikipedia.org/wiki/Publius_(publishing_system)
Let's assume person A publishes 1 MiB of random data on their web server. Afterwards person B XORs illegal content against that data and publishes the result on their own web server (which to an outsider looks like random data). A's file XORed to B's file re-creates that illegal content.
Let's assume that at a later point it's not possible anymore to determine who published their file first. Who is liable for the illegal content? And who needs to remove that data from their server? Neither of them? Both of them? The first variant definitely sounds wrong, but the second variant implies that you can get in trouble for publishing perfectly random data.
You can try to trickety-trick the Feds, but with that particular charge, you're not gonna get out of it. Don't try to outsmart the law on something like this. The best thing to do is to find a way technologically to remove this content from blockchains, and to report whoever had it or created it.
If someone throws a bag full of contraband into your house you're not guilty of possession. It can sit there for an arbitrary period of time without making you guilty of anything as long as you don't know what it is.
If, against your will, someone handcuffs a locked briefcase that you know contains contraband to your wrist, you cannot be guilty of possession of it even though you're in a real sense in possession of it. It can remain there for an unlimited amount of time, and you are not guilty of anything merely because you are unable to remove it.
Immutable data structures pose an interesting problem. Normally we can say that someone knew, or ought of have known something was there. If someone handcuffed a briefcase to you, it's expected that you would freak out and do whatever you could to detach and dispossess it. We haven't had to deal with situations like someone being forcibly tattooed with what they know to be child pornography. If that happened, would the person so marked be guilty of possession if they didn't burn or cut it off?
New technology definitely makes those assumptions highly questionable. Is Google guilty of possession and redistribution of illegal material because it indexed and cached it? It is not. Distributed situations make the issue even more acute. Your computer might need to download, process, and redistribute to others some representation of child pornography, or copyrighted material you have no license to distribute, stolen credit card numbers, classified material, or some other prohibited material. You might even be aware that it is there. But if it is necessary that your software take those actions with that data, that you have no choice, in order to send to confirm receipt of funds, then is it justified or lawful to make it a crime for you to do so?
Certainly not. My point above yours although you were not replying to it is asking a question I'd like to also ask you. We clearly have a very clear definition on what intent is and how that is the resounding factor considered in such a case. However, do we simply do nothing because it's the nature of the project itself to be distributed and immutable history through time. We clearly cannot change the overwhelming applications that technology has so my guess is the only way this is dealt with is a few easy low-hanging fruit items can be done to safeguard against it and if anyone is caught operating outside of that with the sole intent of some illegal activity then we deal with it like we would any other case of illegal materials being found in someone's possession. The nice thing here is that everything is traceable given enough time and calculating power and that this person can theoretically be caught, even if at one point they were to have paid cash for coins with someone off the street. Good old detective work can kick in from there.
I guess I am more curious if these instances can be used to shoehorn law enforcement or the federal agencies into areas that hinder the full capability of the various blockchain applications. I remember back to the San Bernardino shooters cell phone needing to be unlocked and how nail-biting it was that Apple might give away that they had a secret backdoor they were willing to give out to all of our horror. Likewise I hope this doesn't go that same route, and it seems really unlikely, that something such as this would slow the progress of these technologies - not building a backdoor but slowly down transactions to check for illegal content essentially.
Second is you can stomp down on websites that search the blockchain for text, images, videos, illegal documents, etc. However that is not solving the issue directly. However that is hurting a lot of positive potentially interesting uses on account of the very small percentage of abuses. What you essentially have is a GIANT public whiteboard but you've given everyone a permanent marker. If you can control the content that goes in very directly (doing some AI analysis on photos for example) then there will always be a subversive tactic like the XOR one mentioned above, etc.
I suppose the real reason I comment here is that I cannot forsee anyway that these things will not happen and will not continue to happen. Like with ThePirateBay I suppose you have to go after the sites that make it convenient to find this information rather than trying to solve the problem in the blockchain itself _somehow_, which I think we can pretty much agree from a security standpoint and tech-forward approach would render the whole concept of blockchain dubious.
Virtually any data can be decrypted into illegal content. It's a matter of algorithm.
So if one would like to put you in jail, you could be accused of possesing illegal thing, your disk drive could be taken and then cyber crime guys will discover child abuse images in your perfectly valid zip file of a Word document.
Sounds like out of mind but it's technically valid.
And scary.
With regard to illegal child pornography, I'm sure it has a lot to do with the wording of the law, but I think the intersection of how laws are defined and how they may conflict with the natural world (including randomness) is itself interesting.
In theory yes, in practice probably not.
> What about a 64x64 image?
In theory yes, in practice probably not.
> What's the situation like if you have two chunks of data ...
Almost definitely illegal.
So you might think "a 16x16 image can be illegal?! ridiculous!" - well tough, the law doesn't care about how many pixels the image contains, despite a hacker's incredulity.
It was interesting.... so is the image suggestive then, or isn't it?
If we allow all cartoon porn because nobody has been victimized, then the above scenario is more simple - does the image originate from or use as its input an image requiring the suffering/exploitation of a non-consenting party?
This would cover fancy image-hiding methods because you would presumably run a script on some extant photo. You also wouldn't be able to paint your own copy of an abuse photo and claim artistry.
You could also say "all images of abuse, real or imagined", but Australia has shown that legislating thought-only is unproductive. It also wouldn't give much extra social benefit over a less restrictive real-only law.
Reminds me of the library of babel https://libraryofbabel.info/bookmark.cgi?wvlbf.j,qkfjo,wpyrd...
I imagine for someone that doesn't know what's in the file, and doesn't have the the key, it's likely not illegal? For someone that doesn't know what's in the file and does have the key, it probably is, since I think it's about possession, and likely the same for those that know what it is and have they key. But for people that do know what it is and don't have the key? What about that? What about if they don't have the key, but know how to easily get it if they want?
>Can a 16x16 image be illegal?
>What about a 64x64 image?
Depends on the case. If you could show the 64x64 image of child abuse to a stranger and they'd go "that's child abuse" (repeat x12 for a jury) then yes.
However, there's another aspect of possession charges that says the suspect has to be aware they're in possession of an illegal image and able to access it. A 64x64 image is problematic, nobody watches anything in 64p so the only time you would see such a small image is thumbnails. If someone has an illegal image in a thumbs.db file, but they have since deleted the original full-sized image, they likely don't know a thumbnail of the image was being kept on their hard drive. And if they don't know how to extract images from the thumbs.db file they're not in possession.
The interesting loophole in UK law is that you can get charged for "creating" indecent images of children. Popular belief is that it means creating new images but it more often than not refers to creating copies. In the case I mentioned, they could still get arrested for creating a 64x64 copy of the illegal image as a thumbnail. And you can usually prove that they knowingly did something that would trigger the creation of the thumbnail (downloaded the image from a dodgy P2P application 99% of the time).
So to answer this:
>What's the situation like if you have two chunks of data (perhaps at two separate locations on the blockchain) and only if you XOR them you get the illegal image?
It's complicated. Mainly because it's hard to tell who the "you" is in this situation.
But assuming someone is accused of downloading both chunks of data, yes it would be illegal if the person involved knew how to XOR them to get the illegal image. The specific term in UK law is "tools or knowledge". So someone with decades of experience in anything compsci might not have to have any programs capable of XORing the two chunks together if the prosecution can prove they had the knowledge to do so using standard OS tools or write their own script/program.
Really XORing is no different than encryption, you've basically just described a one-time pad. And in any cases involving encryption if you can prove that the person possessing encrypted illegal images had either decrypted them in the past, or has the capability to decrypt them (knows the password, has a keyfile, or can bruteforce) then they're legally in possession. If they had XOR'd the two chunks together already there would likely be a copy somewhere in slack space/unallocated sectors and that would be creation. In the end it would come down to a huge number of factors specific to the case.
Either you have centralization, which nobody wants, or you have a bot that everyone agrees on to censor things, and people will will always find ways around bots. Are there really any other alternatives?
The point is to make it unfeasibly hard to store/send the images, not impossible.
The basic idea is you have a way to delete the data associated with an old transaction but not the transaction itself. A majority have to agree to the redaction though and the fact something has been redacted is recorded.
(Actually, now that I think about it, I guess everyone would say they didn't know the images were there if they were caught in that situation. So I guess that's probably why the Feds just arrest you and charge you with child abuse. That would suck. Just don't use any block chain where that would be possible. Not worth it.)
https://en.wikipedia.org/wiki/Bailey%E2%80%93Borwein%E2%80%9...
So yes, I think that embedding illicit material is a more likely tactic than prohibition. The latter - because it will be such a colossal failure - will only serve to show the state's inability to control the internet, and that's exactly what the state is trying to hide right now.
The second huge fallacy (you are also making it) is that the government wants to ban crypto, but is afraid of saying it and comes up with all kinds of contrived tactics.
"Government" is a term that covers an awful lot of groups with differing agendas.
Law makers make laws. But "government" includes spy agencies, law enforcement, central banks, competing political actors, as well as just rogue individuals.
Making cryptocurrency illegal would require having some degree of popular support (which maybe they would have).
One dude with an agenda, though, could poison the blockchain with a single image. And that one dude (or dudette... i shouldn't be so close minded) could very well be a high-ranking member of a government agency of some sort.
To be clear, I'm not suggesting there's any evidence for this. Just that it doesn't seem entirely unreasonable to consider the possibility.
Two things:
1) child porn is materially different from cannabis or blockchains. Prohibition of child porn is supported widely, and banning production of child porn is supported by, as far as I can tell, nearly 100% of the population. Marijuana, on the other hand, is one of the most popular plant medicines in history. I don't know where blockchains fall on this spectrum, but I think it's fair to say that they're much closer to cannabis than child porn.
2) Sadly, I don't think that banning possession of child porn has been particularly effective, has it? I don't know enough about this area to make an assessment with a high degree of confidence, but the fact that a material that is desired by so few people is still distributed so widely suggests to me that the prohibition has failed.
> The second huge fallacy (you are also making it) is that the government wants to ban crypto, but is afraid of saying it and comes up with all kinds of contrived tactics.
I can see why you thought I was saying that. What I was saying is subtly different: if the state becomes determined to censor blockchain content, I think that it is likely that it will not attempt to do so by naked prohibition, but instead will employ a more indirect and surreptitious strategy.
On the deeper point, of whether the state will come to the conclusion that it wants to disrupt blockchain tech - I think that it probably won't. Whether or not blockchains specifically are understood to be politically powerful and counter to centralized, authoritarian power structures is yet to be seen. But the evolution of the internet more generally clearly is. I'm sure that people who have wielded power through state channels can see that as clearly as anyone, and I don't think they'll be so childish as to stand in the way of the internet, which is a significant evolutionary step for the species.
Global public blockchains are too tempting a target for that type of thing. It will interesting to see how this plays out and whether government agencies respond (or ignore it).
I don't think I'd count on government agencies ignoring child abuse images.
What if someone added data in a form that only later after a viewer appeared will it reveal this type of content. This would make any system with that data immediately illegal.
Looking down the road what it was encoded in dna would it be illegal for someone to read another person's dna?
If someone had a tattoo on there face of one of these images would security cameras need to wipe any data caught?
Speaking of DNA, hypotheticals, and really crazy possibilities: let's assume some troll encodes an illegal image as DNA and implants it (CRISPR is all hype and rage these days, right?) in some sperm; An embryo is generated from this sperm so the image will always exists in this new person and their descendants for a good number of generations.
Nobody with a sound mind will think anybody apart from the initial CRISPR-troll has any guilt here, but the image will exist and once its presence is revealed, the victims will be knowingly generating more copies by just staying alive and passing the "guilt" along by reproducing. And no government could declare a person's life illegal.
It's mildly annoying on its surface but that dissipates when you stop and think about why things are the way they are.
(It's possible I misread your comment and we agree.)
This isn't known for sure. It depends on the digits of pi being normally distributed, which hasn't been proven.
In a way that is made to show the image, perhaps yes.
>If someone had a tattoo on there face of one of these images would security cameras need to wipe any data caught?
Probably not.
These questions are usually thought of as clever "gotchas" for the law. They're not.
> In addition, Money Button has banned the user that uploaded the material.
> It has also put in place filtering systems to spot when anyone tries to upload similar content.
> "We have all the information we need to track down criminals and prosecute them."
Doesn't blockchain technology exist to prevent censorship and provide anonymity (in terms of not being able to link transactions to a real life identity)? So why would anyone want to use a client that collects and stores this kind of information about them? Doesn't it (almost) completely erase the point of having a blockchain in the first place?
And how is this case handled now? Money Button said they forwarded the identity of the uploader to the authorities but is anyone gonna do anything about the problematic data?
For a cryptocurrency, it's relatively important. It's not one of the big boys, but it's supposedly worth $1 billion.
From the singular blockchain to forks of forks, the typical misinformed person's vision of all of this must be profoundly distant from the source of truth. At least it makes a good case study in why trademarks are helpful.
So from the last time this came up: https://thebitcoinnews.com/no-there-isnt-child-porn-on-the-b...
With the important bit here:
80 bytes is all that OP_RETURN can store, and what’s more that information is subject to deletion. That’s because bitcoin nodes are capable of pruning “provably unspendable” UTXOs for efficiency, which include OP_RETURN data.
TL;DR the last time the schadenfreudists were looking for something to point and laugh at on this front, they didn't understand the technicalities of what they were talking about _at all_.
This BBC article makes an interesting claim:
"In January, the amount of data that could be added to the BSV block chain was increased significantly.
Before that, people could generally add only short chunks of text or web links to the block chain.
But now it is possible to add full images in an encoded format."
I've never heard of this BSV coin before, so I don't know the details of this change. Assuming it's a fork of bitcoin and all they did was increase the allowable size of the OP_RETURN, this will once again be sensationalist reporting with no substance. I'd imagine the first thing BSV nodes would do is prune the OP_RETURN garbage because who wants to be paying the storage cost of other peoples embedded images?
But hey, the BBC article is extremely light on details. Maybe this is something that can't be pruned so easily? Does anyone know?
https://blog.moneybutton.com/2019/01/26/how-we-added-support...
https://www.yours.org/content/the-unfuckening-of-op_return-b...
"We’re about to take the red pill and see how deep the rabbit hole of on chain data storage really goes. Tokenized is ready for this, yours.org is ready for this, @_unwriter and his plethora of tools are ready for this as are others. Calvin Ayre has previously spoken of the ‘Cambrian explosion’ of creativity and I believe that unbounded-by-anything-except-fees data storage will be a key trigger for this."
[1]: https://bitcoinsv.io
https://www.wired.com/story/why-porn-on-the-blockchain-wont-...