September 28, 2015

Law Enforcement's Love/Hate Relationship with Cloud Auto Backup

There's a story going around today regarding an individual who was arrested and charged with assaulting a police officer when authorities arrived over a noise complaint. But cellphone video recorded by the arrestee convinced a judge that police had assaulted him, not the other way around. What's particularly unusual in this case is that the arrestee's cellphone had "mysteriously" vanished at the police station before any video was discovered.

So how was the exonerating video ultimately resurrected? Turns out it was saved up on Google servers via the phone's enabled auto backup system. So the phone's physical vanishing did not prevent the video from being saved to help prevent a serious miscarriage of justice.

Lawyers and law enforcement personnel around the world are probably considering this story carefully tonight, and they're likely to realize that such automatic backup capabilities may be double-edged swords.

On one hand, abusive cops can't depend on destroying evidence by making cellphones disappear or be "accidentally" crushed under a boot. Evidence favorable to the defendant might still be up on cloud servers, ready to reappear at any time.

But this also means that we may likely also expect to see increasing numbers of subpoenas triggered by law enforcement, lawyers, government agencies, and other interested parties, wanting to go on fishing expeditions through suspects' cloud accounts in the hopes of finding incriminating photographic or video evidence that might have been auto-backed up without the knowledge or realization of the suspects.

While few would argue that guilty suspects should go free, there is more at stake here.

The fact of such fishing expeditions being possible may dissuade many persons from enabling photo/video auto backup systems in the first place -- not because they plan to commit crimes, but just based on relatively vague privacy concerns. Even if the vast majority of honest persons would have no realistic chance of being targeted by the government for such a cloud search, an emotional factor is likely to be real for many innocent persons nonetheless.

And of course, if you've turned off auto backup due to such concerns, video or other data that might otherwise have been available to save the day at some point in the future, instead may not be available at all.

Adding to the complexities of this calculus is the fact that most uploaded videos or photos on these advanced systems are not subject to the kind of strong end-to-end encryption that has been the focus of ongoing controversies regarding proposed "back door" access to encrypted user data by authorities.

Obviously, for photos or videos to be processed in the typical manner by service providers, they will be stored in the clear -- not encrypted -- at various stages of the service ecosystem, at least temporarily.

What this all amounts to is that we're on the cusp of a brave new world when it comes to photos and videos automatically being protected in the cloud, and sometimes being unexpectedly available as a result.

The issues involved will be complicated both technically and legally, and we have only really begun to consider their ramifications, especially in relationship to escalating demands by authorities for access to user data of all kinds in many contexts.

Fasten your seatbelts.

I have consulted to Google, but I am not currently doing so.
All opinions expressed here are mine alone.

Posted by Lauren at September 28, 2015 08:05 PM | Permalink
Twitter: @laurenweinstein
Google+: Lauren Weinstein