Google Drive's Autodetector For Copyright Infringement Is Locking Up Nearly Empty Files

from the whoopsie dept

We've talked at length about the issues surrounding automated copyright infringement "bots" and how often those bots get the primary question they're tagged with wrong. Examples of this are legion: Viacom's bot takes down a Star Trek panel discussion, all kinds of bots disrupted the DNC's livestream of its convention, and one music distributor's bot firing off DMCA notices to, well, everyone. Google itself has reported that nearly 100% of the DMCA notices it gets are just bot-generated buckshot.

But Google isn't the savior here either. The company also uses automated systems for detecting copyright infringement and, at least in the case of Google Drive, those automated systems occasionally suck out loud at their job.

This week, Assistant Professor at Michigan State University, Dr. Emily Dolson, Ph.D. reported seeing some odd behavior when using Google Drive. One of the files in Dolson's Google Drive, 'output04.txt' was nearly empty—with nothing other than the digit '1' inside it.

But according to Google, this file violated the company's "Copyright Infringement policy" and was hence flagged. And what's worse is, the warning sent to the professor ended with "A review cannot be requeste for this restriction."

If your bot thinks a single digit is somehow copyright infringement, then your bot is a bad bot and should be taken behind the woodshed and humanely sent to bot-heaven where it can run and frolic with all the other bots. Now, to be fair, there is an open question in this case as to whether the filepath names that were chosen somehow were what was getting flagged. And, sure, maybe that happened. But it doesn't really change the point: a bot thought a file that contained a single integer was copyright infringement.

That being said, other Drive users have reproduced this, calling into the question the filepath theory.

Dr. Chris Jefferson, Ph.D., an AI and mathematics researcher at the University of St Andrews, was also able to reproduce the issue when uploading multiple computer-generated files to Drive. Jefferson generated over 2,000 files, each containing just a number between -1000 and 1000.

The files containing the digits 173, 174, 186, 266, 285, 302, 336, 451, 500, and 833 were shortly flagged by Google Drive for copyright infringement.

Again, this sucks. For what it's worth, Google has finally responded and, despite the notices indicating there was no way to dispute the bot's findings, has been sharing out links to do exactly that. But that isn't really the point. This is base-level stuff here: having a system that operates this poorly means you have a system that never should have been in production to begin with. Particularly, frankly, when that system is operating as personal file storage for many, many people.

Filed Under: automated filters, censorship, copyright, dmca, filters, google drive, hard drives, upload filters
Companies: google

Now Israel Is Looking To Pass A Social Media Censorship Bill Too

from the this-will-be-abused dept

Like lots of other places around the globe, it appears that Israel is considering a dangerous social media censorship bill, that would force websites to remove content. It does have some safeguards, but, basically, if law enforcement claims a crime was committed via the publication of some content, a judge can issue a takedown order:

Under the proposed bill, a judge would be able to issue an order requiring a content publisher to remove posts from its website, if law enforcement agencies are convinced that a criminal offense has been committed through the publication of the content. It essentially allows Israeli authorities to block posts from any website featuring user-generated content, including Google, Twitter and Facebook, as well as news sites from being seen by Israeli viewers, including those with a paywall and those that require user registration.

That doesn't seem like real due process, of course. From the sound of it, you only have two parties involved -- law enforcement and the judge -- and not anyone representing the actual content creator/publisher. Thankfully, at least some are raising the alarm in Israel over this attack on free expression:

“The bill is broader than necessary and offers a substantial and procedural opening for government censorship,” the authors wrote. “Moreover, the bill also makes it possible to remove content from institutional content sites, like Israeli and foreign newspapers, at a level of intrusion that does not exist in any other country in the democratic world.”

Shwartz Altshuler told The Times of Israel on Tuesday that “the law applies to any website, with a paywall, or without, with registration or without. This means that one could go to court and ask for content removal even from news sites, which is unheard of.”

As they note in the article, this bill goes significantly further than the already wildly abused NetzDG law in Germany.

Among other things the law says it can be used for any crime that "might harm public safety" which is the kind of thing that law enforcement will claim at the drop of a hat about almost anything. Hopefully, legislators in Israel realize that this bill is half-baked.

Filed Under: censorship, content moderation, due process, israel, social media

Google Blocked An Article About Police From The Intercept... Because The Title Included A Phrase That Was Also A Movie Title

from the but-content-moderation-is-easy dept

A week before Christmas, Radley Balko published a typically excellent story about the police chief in Little Rock, Arkansas, Keith Humphrey. It's a good story, and you should read it. Humphrey, who was appointed police chief as part of a reformist campaign, has faced on ongoing campaign to try to take him down from stalwarts within the Little Rock police department, including a few others who wanted his job -- but mainly by the local police union, the Fraternal Order of Police. Anyway, what caught my attention was that a few days after the article went live, The Intercept reported that it had been removed from Google search due to a DMCA copyright takedown notice.

This raised a lot of eyebrows, including questions of whether or not some of the characters who come out of the story negatively were abusing the DMCA to get the story disappeared from Google. It also surprised some people who didn't realize that you could issue a DMCA complaint to Google to get something removed from search. Over the holidays, however, the actual story came out and it's even dumber and more pointless than you could have imagined, but it does highlight (yet again) just how incredibly broken the copyright system is these days.

First off, the "Google removal" bit is nothing new. Even though you might think that DMCA takedowns should only be handed to sites that actually host the content in question, hosts are only one part of the DMCA 512 rules. That's the part that most are familiar with, 512(c) with the rules for dealing with "information residing on systems or networks at direction of users." That's the part that has all the standard notification and takedown rules. But there's also 512(d), which is for "information location tools" and says that if such a tool is notified of infringement -- using the same method in 512(c) -- you have to "respond expeditiously to remove, or disable access to, the material that is claimed to be infringing or to be the subject of infringing activity.

In other words, yes, if someone wants to block something from being found via Google, they can try to file a DMCA takedown claim, saying that the content is infringing. We've seen this used and abused plenty over the years. You may remember revenge pornster Craig Brittain who sought to use this system to get links to a bunch of articles about him removed from Google (this included the press release from the FTC about him settling with them for his sketchy revenge porn efforts). In fact, Brittain tried this multiple times.

Indeed, many copyright holding entities don't even bother to go after the hosting of infringing materials -- they find it more expedient to just have that content de-linked from Google. As Google notes in its transparency report, it has been asked to delete 5.5 billion URLs from its index. For what it's worth, elsewhere, Google has reported that the vast majority of URLs it is told to delete aren't even in its index -- but it's still pretty crazy. And while Google at least has a team that tries to review these requests, mistakes happen, because mistakes always happen at this scale.

In this case, this was clearly a mistake. But it's an incredibly stupid mistake, so it's worth highlighting. Notably, Google put the link to Balko's story back into Google a few hours after The Intercept publicly complained about it, but it took another week or so until the actual DMCA notice made its way to the Lumen Database where we could finally see just what caused it. Was it the annoyed Fraternal Order of Police in Arkansas? Or just other annoyed cops?

No. It was a cybersecurity company that is apparently really bad at it's job.

The notice came from Group IB a "cyber threat" company based in Singapore that claims to specialize in the "prevention of cyberattacks, online fraud, and IP protection." It claims to be an "industry-leading cybersecurity solutions provider" but it frankly looks like most of the other companies in the space which probably shouldn't exist. This notice was sent on behalf of a Russian firm: ООО "РАЗВЛЕКАТЕЛЬНЫЙ ОНЛАЙН-СЕРВИС." As far as I can tell this seems to translate into Online Entertainment Service Limited Liability Company -- about as generic a name as you can find. The company was only created in the summer of 2020, so it's a relatively new company.

And, apparently, it hired Group-IB to issue takedown notices for a bunch of Netflix shows and movies. From the notice, I would guess that the Russian company is supposed to be trying to take down Russian translations of these Netflix shows, because while all of the names listed in the notice are from Netflix, they're each listed with their English name... and their Russian name. And most of the URLs in the notice do appear to be to various sketchy film download sites. Also, in listing the "original URLs" (which are supposed to show the original copyright covered content), the notice lists both the American IMDB site URLs... and the Kinopoisk.ru links, which is a Russian IMDB-like site owned by Yandex, the big Russian internet company.

So, for example, the takedown for "Stranger Things" in this notice looks like this:

DESCRIPTION: series "Stranger Things / Очень странные дела" (2016)
ORIGINAL URLS:
01. https://www.kinopoisk.ru/series/915196/
02. https://www.imdb.com/title/tt4574334

So... it's actually possible that this company was hired by Netflix, but that's not entirely clear. Still, how does this lead to The Intercept having its story taken out of Google? Well, one of the takedowns was for the film The Old Guard, which is a Netflix production starring Charlize Theron, released in 2020. I'd never heard of it but it gets decent reviews on Rotten Tomatoes and apparently a sequel is being made.

Of course, you still may be shaking your head as to what any of this has to do with The Intercept's story about Police Chief Keith Humphrey. But it's right there in the takedown demand:

The other URLs listed do seem to lead to sketchy download sites, meaning they likely are pirated versions of the film. But, why is The Intercept article targeted? It seems the most obvious explanation -- as stupid as it sounds -- is that the subhead to The Intercept story mentions... "the old guard" as those trying to takedown Chief Humphrey.

If you can't see that, it shows the title and sub from The Intercept:

So... the most likely explanation here, as stupid as it seems, is that Netflix has some sort of deal with this silly Russian company, which hired the Singaporean "cybersecurity" firm Group IB to try to "police" the internet of infringing works in Russia... and in their lazy Googling for infringing copies of these Netflix shows and movies, they searched for "the old guard" and just grabbed various URLs, and didn't check all of them, meaning that The Intercept's story about Chief Humphrey got caught up in the mess... and, especially over the holidays with probably a lot of Google's copyright takedown checkers on vacation, nobody caught that this was obviously a mistake until The Intercept (understandably) raised a stink.

For most normal people this would be yet another sign of how broken our copyright system has become, but unfortunately it's the way things work these days.

Filed Under: censorship, copyright, dmca, journalism, little rock, radley balko, reporting, russia, takedowns, the old guard
Companies: google, group-ib, netflix, the intercept

Indian Gov't Orders YouTube To Block 20 Channels For 'Blasphemy' And 'Impinging On National Security'

from the wherein-Piss-Christ-is-the-same-thing-as-a-pipe-bomb dept

India's Information Technology Act has been problematic since its inception. Almost a decade ago, it was deployed to justify the arrest of an Indian citizen who'd done nothing more than criticize a politician, insinuating the politician had used his position to amass personal wealth.

Once the politician complained, the government ignored available libel law, which would have resulted in a civil case and opted to use a clause of the IT Act which allowed prosecution for "sending an email or other electronic message that causes annoyance or inconvenience." That's how the law was used in 2012.

The 2021 version of the law is much more dangerous. Folding into the act passed in 2000 are new rules about national security. This escalates the Act's abusability, since nearly anything can be called a threat to national security and drastically limits the defenses those targeted by this part of the act can raise.

Added into this revision are new mandates for social media companies, which allows the government to hold companies responsible for content created by their users. There's a long list of forbidden content that starts with child sexual abuse material and terroristic content and ends with things like "promoting tobacco use," "blasphemy," and "harms minors in any way."

It is those changes that have resulted in the banning of 20 supposedly "anti-India" YouTube channels.

India banned 20 YouTube channels and two websites on Monday for allegedly running anti-India propaganda from Pakistan, invoking for the first time the emergency powers under the newly notified intermediary guidelines and digital media ethics code in the IT Act.

I&B secretary Apurva Chandra wrote to YouTube and the Department of Telecom, directing them to immediately block the content as it affects the sovereignty and integrity of India, people aware of the development told ET on condition of anonymity.

According to officials, these channels were being run by a Pakistan government agency. The officials also made reference to fake news and reporting on farmers' protests. The first is another term as abusable as "national security." The latter is something the Indian government has expended a lot of effort to control the narrative, often through censorship.

This is censorship as well. Even if we accept the Indian government's assertions about the origin and intent of the banned channels, the government can't even decide why it's doing this. It claims two violations -- neither of which should have anything to do with each other.

The inquiry revealed that these websites were being run from Pakistan. The content run on these channels is blasphemous and hugely impinges on national security," said the official, who was part of the review.

If your national security and national religion are intertwined, a law addressing both is a censorial cudgel. And it won't make anyone safer or make your religion any more unassailable. What it will do is allow the government to disappear information and content it doesn't like with impunity.

This has been the point of the law all along. Every iteration gives the government more power and takes it away from the country's citizens and the services they use. It elevates the government, placing it on the same level as its preferred deities. When a government does that, it no longer serves the public. The public is now expected to serve (and revere) the government.

The Indian government has all the tools it needs to ensure its narrative is the most prominent. Even before these amendments affecting intermediary liability went into effect, the government had pulled the plug on the internet in areas where farmers' protests were taking place and threatened Twitter employees with arrest for restoring accounts and content the government had ordered removed. More assertions about god(s) and country are undoubtedly on their way, forcing those carrying third party content to give the Indian government control of the narrative or face fines, fees, and possible imprisonment.

Filed Under: blasphemy, censorship, content moderation, free speech, india, information technology act, national security, pakistan
Companies: youtube

Tanzania's Abuse Of US Copyright Law To Silence Critics On Twitter Should Be A Warning For Regulators Looking To Mess With Content Moderation

from the it-will-always-always-be-abused dept

We were just highlighting how rules that enable the easy takedown of content on social media will always lead to over-blocking, and this is why we should be quite careful about government attempts to mandate content removal -- like those of Senator Amy Klobuchar to require websites to remove "health misinformation." It's not like we don't have tremendous evidence of this. Daphne Keller over at Stanford has been keeping tabs on studies of "over-removal", with the key culprit being copyright law.

In the US, copyright law remains the main tool for silencing speech (which is why there's still a very strong argument that the DMCA fundamentally has a 1st Amendment problem). It didn't get that much attention, but a recent revelation from Twitter about removing networks of coordinated inauthentic behavior online, reveals just how US copyright law can be weaponized by foreign governments to silence critics -- and it should be a very loud warning to those looking to create government mandates for the removal of information online.

Twitter shared the details of these removals with the Internet Observatory at Stanford and it's from that organization's report that the details of what happened here come. However, Stanford IO released reports on a bunch of different networks at once, so what happened with Tanzania seems to have gotten less attention than the overall set of examples. But the Tanzania example should send up signal flares about why making it easy to remove content online is so dangerous.

For years we've highlighted a tactic that people have used to silence others: faking a copyright on material and then claiming infringement. The tactic is stupidly brilliant. If you find some content you don't like, just copy it onto your own website/blog and then backdate it so it looks like it came out before the content you want to have deleted. Then, send a DMCA takedown notice claiming that yours is the original, and the actual original is infringing.

A year ago, the good folks at Access Now spotted how they had been alerted to Tanzanian activists being silenced on Twitter through this technique:

Notably, ahead of Tanzania’s upcoming elections, our Helpline has received reports of hundreds of DMCA takedown demands to censor Tanzanian activists on Twitter.

Twitter has now dealt with this effort, but the details, as noted by Stanford are really eye-opening.

Twitter suspended a network of 268 accounts that were supportive of the Tanzanian government and used copyright reporting adversarially to target accounts belonging to Tanzanian activists and an opposition politician. This Tanzanian operation worked by first taking text or images tweeted by accounts that criticized the ruling Chama Cha Mapinduzi party, then putting the same content on WordPress sites and modifying the date to make it appear as if the WordPress post preceded the tweet. Fake accounts pretending to be Tanzanians or South Africans then reported the content to Twitter for violations of the US Digital Millennium Copyright Act (DMCA). Twitter then notified the accounts of the reported copyright claim. To counter such DMCA takedowns, however, the accused copyright infringer must share their personal information with Twitter. At least one of the targeted accounts relied on anonymity for safety, possibly making it undesirable for them to counter through Twitter’s process. This operation succeeded in getting Twitter to suspend at least two of the targeted accounts, though both have since been reinstated.

The details in the report show the lengths that this network went through to abuse US copyright law to silence Tanzanian activists.

The typical starting point in this operation was a tweet—sometimes just text, sometimes with an image—from a targeted account, which included the prominent activist known as Kigogo (@kigogo2014 on Twitter, 640,000 followers). Kigogo is affiliated with human rights organization Fichua Tanzania, which advocates for a politically free and open Tanzania. @kigogo2014 is a pseudonymous account that shares inside information on the country’s elites and is on occasion critical of the government, which has threatened to unveil and arrest the individual behind the account. Also targeted in this scheme was @RealHauleGluck (237,000 followers), who self-describes as a human rights watcher in Tanzania.

The network then created websites—we know of three of them based on a tweet from @kigogo2014 (see Figures 3 and 4). These sites were undeveloped and existed exclusively to post content copied from the targeted Twitter accounts. Each post on the websites was typically just an image or some of the words from the original tweet.

You can see an archive of one of these WordPress sites. It has no real info on it other than copies of the tweets or images in the tweets. The Stanford researchers looked at the metadata of the WordPress posting to see how they were backdated:

These websites then backdated a blog post to make it appear as if it had been created prior to the date of the original tweet. For example, Figure 5 shows source code from one of the WordPress sites. The post shows the publication date of September 27, 2020, making it appear as if it had been published several days before the original content was tweeted on October 1, 2020—but the source code shows the post was actually edited on October 2, 2020. Note that the minute fields for the published and updated dates are within two minutes of each other (19 and 21, respectively), further suggesting that the blog post was created on October 2nd at 3:19pm, manually backdated to September 27th (but preserving the time field at 3:19pm), then completed on October 2nd at 3:21pm.

Metadata. It'll get you every time.

But the real weaponry here was... the US DMCA notice-and-takedown scheme:

In the next step of the scheme, Twitter accounts in the network filed DMCA complaints on Twitter. From screenshots the targeted accounts posted (see Figure 6 on the following page), we can see what these complaints looked like. They include a name—likely fake, and often appear to be Nigerian. The phone number does not appear to map onto the format of real phone numbers in Tanzania, where cell phone numbers begin with +2557 or +2556 and landline numbers begin with 02. Additionally, the same phone number was used for complaints linked to multiple individuals. The complaints linked to the allegedly violative content, along with the “original” content. In one somewhat comical example, the complaint was over a generic photo of a sunset (Figure 7 on page 8).

The newstzolivia.wordpress.com site had a post that consisted entirely of likely backdated tweet-length content, often stolen from @kigogo2014; examples are shown in Figure 8 on page 9. The site listed the email patelolivia719@gmail.com under one post, and one of the suspended accounts used the display name Olivia Patel. The account, created on June 16, 2020, had no followers.

The complaints also included the address of the complainant. Interestingly, 99 of the suspended Twitter accounts included an address in their bio, primarily in South Africa. We suspect the network thought their complaints would seem more credible if the address listed in the complaint matched the address listed in the bio, though it is unclear if this mattered. Many of the accounts that listed addresses had no visible tweets, suggesting their primary purpose may have been copyright reporting.

While this network was caught, and the suspended Twitter accounts were reinstated, this still should serve as a warning sign. When you, under the threat of legal liability, force websites to remove content based solely on the say-so of reporters, it will inevitably be abused, and sometimes to dangerous ends.

This is just the latest striking example of how that works.

Filed Under: censorship, content moderation, copyright, dmca, tanzania
Companies: twitter

Germany's New Government Promises To Support End-To-End Encryption And Reject Backdoors

from the finally-someone-is dept

A bit of welcome news as the war on encryption continues around the globe. Germany's new government has said that it plans to come out more strongly in favor of end-to-end encryption and against backdoors. According to a report in Euractiv:

According to Jens Zimmermann, the German coalition negotiations had made it “quite clear” that the incoming government of the Social Democrats (SPD), the Greens and the business-friendly liberal FDP would reject “the weakening of encryption, which is being attempted under the guise of the fight against child abuse” by the coalition partners.

Such regulations, which are already enshrined in the interim solution of the ePrivacy Regulation, for example, “diametrically contradict the character of the coalition agreement” because secure end-to-end encryption is guaranteed there, Zimmermann said.

Introducing backdoors would undermine this goal of the coalition agreement, he added.

“What is sometimes proposed in the ePrivacy Regulation goes far beyond what we envisage in terms of vulnerability management,” Zimmermann told EURACTIV, adding that implementation would “mean actively creating vulnerabilities.”

This is certainly good to see, but it's also important to have a country with as much clout as Germany standing up and saying this. Indeed, Zimmermann is also quoted as saying that the new German government plans to take a more vocal and proactive role on this issue.

Unfortunately, not all of the new coalition government's views on the internet appear to be as good or as helpful. The same article also notes that while some parts of the new governing coalition had campaigned on getting rid of Germany's truly awful NetzDG internet censorship law, the new government does not plan to support such a position, and may, in fact, support a similar EU-wide plan within the Digital Services Act (DSA) which is currently up for debate in the EU.

Germany’s Network Enforcement Act (NetzDG), which has a similar scope to the EU’s DSA and has served as its model, according to Zimmermann, is not without controversy in the country.

The FDP campaigned for its abolition during the Bundestag election campaign because, according to the liberal party, it encroached too much on civil liberties.

But Zimmermann does not believe the liberal party would drag its reservations on the NetzDG into discussions on the EU’s DSA.

“It is no longer a question of winning any symbolic victories, but we simply have to see that we get a good regulation in the end,” Zimmermann said.

That's an odd statement that seems to suggest that protesting the disastrous and censorial NetzDG is "symbolic." It's not. It's a terrible law that has been abused repeatedly and should be ditched entirely, not spread to the EU.

Filed Under: backdoors, censorship, civil liberties, content moderation, encryption, germany

Turkey's Dictator Erdogan, Who Has Sued Thousands Of Critics, Jailed More, Now Claims That 'Social Media' Is A 'Threat To Democracy'

from the takes-one-to-know-one dept

In the past we've pointed out how western politicians' attacks on social media are only serving to play into the hands of authoritarians around the globe, justifying their crackdowns on free speech and critics. And that doesn't seem to be slowing down any time soon. The latest is Turkey's President repeating the exact lines that US/EU politicians have been using to slam social media as "dangerous to democracy" in order to justify even more draconian crackdowns on speech and the press in his country.

We've written about Turkey's President Recep Tayyip Erdogan for years -- mostly covering his regular attacks on free expression. Erdogan has sued thousands of people for "insulting" him online. Even more serious is his regular practice of jailing journalists by falsely calling them terrorists. He's also lead aggressive campaigns to ban any website that portrays him in an unflattering light.

So, you'd think that maybe US/EU politicians might recognize the problems of someone like Erdogan using their own words to further push his agenda. This weekend, Erdogan announced that social media is a "threat to democracy" and pushed for new laws that would criminalized "fake news" being spread on social media.

“Social media, which was described as a symbol of freedom when it first appeared, has turned into one of the main sources of threat to today’s democracy,” Erdogan said in a video message to a government-organised communications conference in Istanbul.

He added: “We try to protect our people, especially the vulnerable sections of our society, against lies and disinformation without violating our citizens’ right to receive accurate and impartial information.”

I mean, that sounds nearly identical to claims made by people like Senators Amy Klobuchar, Josh Hawley, Elizabeth Warren, or Ted Cruz. Of course, there is no actual democracy in Turkey right now, and Erdogan is just using these claims to justify even greater suppression of speech that criticizes him. As we've highlighted over and over again hate speech laws always turn into a mechanism for the government to punish people they don't like.

As the article notes, Turkey has already moved to have much great control over social media companies, and this new move will ratchet up the pressure:

Turkey passed a law last year requiring social media platforms that have more than 1 million users to maintain a legal representative and store data in the country. Major social media companies, including Facebook, YouTube and Twitter, have since established offices in Turkey.

The new legislation would make the dissemination of “disinformation” and “fake news” criminal offences punishable by up to five years in prison, according to pro-government media reports. It also would establish a social media regulator.

It seems like those US social media companies may want to reconsider their local offices.

But, even more to the point, US and EU politicians going out of their way to exaggerate and slam social media as a "threat to democracy" might want to think a bit more about how their words are being used, almost verbatim, as a justification around the globe to suppress free speech and political criticism.

Filed Under: censorship, democracy, hate speech, recep tayyip erdogan, regulations, social media, turkey