Shared YouTube data prompts civil liberty worries:
If you've ever jokingly wondered if your search or viewing history is going to "put you on some kind of list," your concern may be more than warranted.
In now unsealed court documents reviewed by Forbes, Google was ordered to hand over the names, addresses, telephone numbers, and user activity of Youtube accounts and IP addresses that watched select YouTube videos, part of a larger criminal investigation by federal investigators.
The videos were sent by undercover police to a suspected cryptocurrency launderer under the username "elonmuskwhm." In conversations with the bitcoin trader, investigators sent links to public YouTube tutorials on mapping via drones and augmented reality software, Forbes details. The videos were watched more than 30,000 times, presumably by thousands of users unrelated to the case.
YouTube's parent company Google was ordered by federal investigators to quietly hand over all such viewer data for the period of Jan. 1 to Jan. 8, 2023, but Forbes couldn't confirm if Google had complied.
SEE ALSO: Users get a taste of Google's AI search results, unprompted
The mandated data retrieval is worrisome in itself, according to privacy experts. Federal investigators argued the request was legally justified as the data "would be relevant and material to an ongoing criminal investigation, including by providing identification information about the perpetrators," citing justification used by other police forces around the country. In a case out of New Hampshire, police requested similar data during the investigation of bomb threats that were being streamed live to YouTube — the order specifically requested viewership information at select time stamps during the live streams.
"With all law enforcement demands, we have a rigorous process designed to protect the privacy and constitutional rights of our users while supporting the important work of law enforcement," Google spokesperson Matt Bryant told Forbes. "We examine each demand for legal validity, consistent with developing case law, and we routinely push back against over broad or otherwise inappropriate demands for user data, including objecting to some demands entirely."
Privacy experts, however, are worried about the kind of precedent the court's order creates, citing concerns over the protections of the first and fourth amendments. "This is the latest chapter in a disturbing trend where we see government agencies increasingly transforming search warrants into digital dragnets," executive director of the Surveillance Technology Oversight Project Albert Fox-Cahn told the publication. "It's unconstitutional, it's terrifying, and it's happening every day."
(Score: 5, Insightful) by BsAtHome on Monday April 01, @11:46AM (3 children)
And that is why (personalized) streaming video/TV is a Bad ThingTM.
It is just a matter of time before you will be categorized as "good", "bad" or "dangerous", just by looking at your streaming records. They will then come for you for a personal reeducation session. It has happened before and it will happen again.
(Score: 3, Interesting) by jasassin on Monday April 01, @03:24PM (2 children)
I agree. I switched from using Plex as my media streaming server to Jellyfin. Mostly because Plex makes you login to use it (also because Jellyfin doesn't make you PAY to use hardware acceleration [WTF?]). I despise this account BS. I don't want some assholes tracking the movies I watch on my own server at home! Fuck Plex, and any app that requires you login for no functional reason (only to harvest personalized data).
While I do use Youtube for the occasional music or how-to video I don't ever login to it.
jasassin@gmail.com GPG Key ID: 0xE6462C68A9A3DB5A
(Score: 1, Insightful) by Anonymous Coward on Monday April 01, @08:30PM
They still track you. I never log in either. I can clear cookies, get a new dynamic IP and start clicking on youtube links. It's really easy to tell when they match you up again, the list of videos on the side will suddenly change to be more related to your overall viewing rather than that session. Usually it's before the end of the first video.
(Score: 4, Interesting) by JoeMerchant on Monday April 01, @08:45PM
I started video storage/serving from NAS in 2008 with Kodi on local hardware, never looked back.
Whatever we want to see, we can generally get on disc, the disc can generally get on the server and from there it's nobody's business if, when, or how many times it's viewed or by whom within the household.
By contrast, our Netflix and D+ accounts purport to ask who is watching "to Serve you [wikipedia.org] better," and I'm fairly certain they also track which physical device is doing the showing.
🌻🌻 [google.com]
(Score: 3, Insightful) by DadaDoofy on Monday April 01, @11:53AM
This is one of the many reasons why you should never, ever use Google. For anything.
(Score: 4, Interesting) by EJ on Monday April 01, @12:46PM (5 children)
I get that some people don't like Google knowing everything about them, but some people live alone.
Google may be the only one that can confirm they were, indeed just sitting at home alone, playing video games.
(Score: 5, Insightful) by Ox0000 on Monday April 01, @01:07PM (2 children)
Are you suggesting that we continue to allow google to abuse everyone it can set its sights on, purely because "they may at some point in the potential future have data that could maybe indicate the possibility of an alibi assuming all the other stars line up?"
Remember that this information will only ever be used against you, it will never be used in your favor. I have yet to see a case where "queries against google from the dwelling of the accused" is successfully used to acquit the accused. Something like that would be very, very easy to mock up with a combination of selenium, the firefox driver, and some python (or any other languages with Selenium-bindings exist).
Google is not your friend, corporations are not your friend. They don't like you and only abide with you for as long as they can extract money from you. After that, you will be discarded like the empty husk that they have then classified you as.
In the words of Samuel Adams: “If you love wealth greater than liberty, the tranquility of servitude greater than the animating contest for freedom, go home from us in peace. We seek not your counsel, nor your arms. Crouch down and lick the hand that feeds you; May your chains set lightly upon you, and may posterity forget that you were our countrymen.”
(Score: 4, Touché) by EJ on Monday April 01, @01:23PM
I'm suggesting that I found the idea amusing.
(Score: 4, Insightful) by JoeMerchant on Monday April 01, @08:56PM
>Are you suggesting that we continue to allow google to abuse everyone it can set its sights on
Not that they don't, but in this particular case you could substitute Google with Vimeo or any other video streaming service provider - it's the government(s of the world) who are doing the actual abuse, how complicit Google or anyone else is in the abuse is a hard thing to judge. How many $Billion$ would you part with over privacy principles if you were in the decision making chair?
In the medical device industry, we face similar regulatory compromises all the time. Sure, FDA EU-MDR and the rest are requiring tremendous quantities of R&D person-hours complying with absolutely bat-shit-crazy regulatory paperwork requirements, but if we don't comply then our products don't reach the market and they don't improve peoples' lives. Sure, we profit along the way, but we also seem to be serving a demand for quality (and quantity) of life improvements - based on the money everybody throws at us for the products we do successfully market. So... stand on principles, fight the machine, likely lose and get nothing in customer hands, or go along with government demands and at least get 20-30% of what you could without all the regulatory compliance B.S.?
I will say this: Google is likely the source of the "leak" for this story - and that's slightly less evil than they could be in this particular situation. When the all the three letter agencies of five-eyes and beyond were putting trunk-traffic inspection/archive/analysis gear in the closets of all the major ISPs (early 2000s), how long did it take for that story to leak in a credible fashion?
🌻🌻 [google.com]
(Score: 2) by looorg on Monday April 01, @04:37PM (1 child)
How do we know it wasn't a bot/script playing and being online why you went outside on some serialkiller rampage ... Clearly they need more monitoring. Or being home watching TV or being online is really a poor alibi.
(Score: 2) by EJ on Tuesday April 02, @02:14AM
Because Google knows everything.
Google
Knows
EVERYTHING...
(Score: 4, Insightful) by Ox0000 on Monday April 01, @12:59PM (11 children)
Not my quote, but very apt indeed:
What I'm missing is a list of the URLs of the videos. Not because I'm concerned (I don't use YT and stay as far the heck away from anything google as I can) but because it may offer tantalizing insight into and warning for future entrapment schemes like this.
(Score: 5, Interesting) by zocalo on Monday April 01, @03:09PM (8 children)
Then again, I suspect that ship has already sailed. Reading between the lines, I think this was a variation on a canary trap. They've sent a bunch of presumably entirely legit video links to this "elonmuskwhm" on topics they have expressed a personal interest in ("mapping via drones and augmented reality software") so, by looking at who has accessed a significant number of the videos, they can narrow down who the person might be IRL, and maybe cross reference that against data obtained elsewhere for further corroboration. If so, the upshot will be knowing the URLs won't help anyone else being targetted like this as the topics would be specific to the target.
UNIX? They're not even circumcised! Savages!
(Score: 2) by sjames on Monday April 01, @07:40PM (7 children)
I also doubt they'll release the URLs, but according to the reports, they have about 30K views so the well is fairly well poisoned already. They don't even know for a fact if the person they sent them to actually watched them, much less if he was signed in at the time or even using his own device to do it.
So out of the ~30K views reported, it may be that NONE point to the suspect.
(Score: 2) by JoeMerchant on Monday April 01, @09:01PM (2 children)
>I also doubt they'll release the URLs
Basic principles: take what you can, give nothin' back.
>according to the reports
They requested the viewership info from a seven day window, but the 30K views is (more likely) the lifetime count of the videos on the list. If you're looking at the videos today, they don't really care about you (or, do they?)
I would guesstimate they came away with a list of less than 1000 user IDs - because: it would cut into coffee and doughnut time if they actually had to run down 30K people as potential suspects.
🌻🌻 [google.com]
(Score: 2) by sjames on Tuesday April 02, @07:17AM (1 child)
The numbers look about right. But tracking down 1000 which may or may not include the person of interest is still a good bit of work and potentially problematic for the other 999 people.
(Score: 2) by JoeMerchant on Tuesday April 02, @11:27AM
Out of the 1000, I suspect 950 were "quick filtered" by criteria they already had for the suspect, but yeah, the other 50 probably got a closer look, and if none of them immediately came clear as the desired target, they probably got a closer look that did violate their rights to privacy in extreme ways... potentially resulting in a "random tip" to other law enforcement agencies about something else completely unrelated.
🌻🌻 [google.com]
(Score: 1) by khallow on Tuesday April 02, @03:04AM (3 children)
Depending on the value and difficulty of the target, it may well be worthwhile to have narrowed down the search this much.
(Score: 3, Informative) by sjames on Tuesday April 02, @05:33PM (2 children)
Even with that, they might narrow it down as much as one out of a thousand or so people. They still wouldn't know if the one they were interested in signed in to watch or perhaps watched it at an internet kiosk at a library or over wifi at a Starbucks.
So if the person of interest was taking precautions, they would get only a NATed IP address from a busy location somewhere and no real way to follow that up.
(Score: 1) by khallow on Wednesday April 03, @06:03AM (1 child)
Even if that happened, it still narrows the field. The real problem here is not the difficulty of narrowing the search for bad guys, but that it creates an easily exploitable loophole for hoovering up information. Imagine this scenario: Officer A pretends online to be a hacker with a sufficiently criminal record. Officer B in keeping with the theater pretends to be luring said imaginary hacker with certain subversive videos. The officers selectively present the actions (neglecting of course to mention how contrived and fake the whole situation is) as a normal criminal case with the hoover search warrant being required to find the hacker. But what they're really interested in is getting a list of the people who watched the subversive videos.
(Score: 3, Informative) by sjames on Wednesday April 03, @10:59AM
The thing is, they have no probable cause to investigate the list. It's a list of people who did a thing that isn't a crime (watched the videos). ONE of them also did things (presumably) worthy of investigation, but since they don't know which one.
It's the same reason they can't just question everyone at a concert even though it's a fair bet at least one person attending has used drugs. Without something beyond that to suggest a particular concert goer, they're SOL.
(Score: 2) by bart9h on Monday April 01, @05:41PM (1 child)
So we can all watch them, and tell everybody we know to do so too, so we can poison their well?
(Score: 2) by JoeMerchant on Monday April 01, @09:03PM
>we can poison their well?
That would be more like pissing in their cornflakes, which you tracked down in the landfill months after they discarded them.
🌻🌻 [google.com]