Should Google Scan Personal Files for the Public Good?

In August of 2022, The New York Times published a story about a father named Mark whose child’s pediatrician requested a photo of his son’s intimate parts for a medical diagnosis. The father took and submitted the photos, and the doctor diagnosed the boy [3]. Along the way, the images were marked by Google as child sexual abuse material (CSAM), and the father was permanently suspended from all Google services [2].

This unfortunate story raises an interesting debate between privacy (whether big tech companies should have access to personal photos) and the public good (preventing child sexual abuse). Both are outlined in the Association for Computing Machinery (ACM) and the Institute of Electrical and Electronics Engineers (IEEE) Computer Society’s code of ethics, which begs the question: How can these ideals coexist?

First, it would be beneficial to examine how Mark’s photos were marked as CSAM. Neither Google nor any current major phone manufacturer scans the images stored locally on your phone. Instead, the issue arises when you upload photos to personal Cloud storage, such as Google Photos. Once in the Cloud, the hosting company, such as Google, has agency over the images. Typically, they are hashed – each image is mapped to a unique digital code called a hash and compared to existing hashes of known CSAM. However, the photos of Mark’s son would not show up as CSAM using this method because Mark’s photographs could not have already been in a database – they were original. Instead, Google has trained an artificial intelligence to recognize CSAM in completely original media, and if the AI detects something, it is marked for review by a human. If the human deems the photo inappropriate, a report is made and dealt with by relevant law enforcement [3]. This case highlights the debate over whether big-tech companies should be able to scan people’s files, whether big-tech companies should actively participate in preventing crimes, and whether big-tech companies should suspend users from their services in cases like these.

To begin with, should big tech companies be able to scan personal files? The ACM Code of Ethics asks computer scientists to “respect privacy.” They seek to prevent “accidental disclosure” of data, “allow individuals to understand what data is being collected and how it is being used,” and collect “only the minimum amount of personal data necessary” [1]. The service Google provides is cloud storage, so any file one uploads to Google Photos or Google Drive will be collected by Google. However, to fulfill the service’s function, Google only has to store the data. The photos a user uploads do not have to be hashed, and they do not have to be processed by an AI. Since the ACM Code of Ethics asks that computing professionals do not violate the “rights of individuals and groups,” and privacy is considered a universal human right, Google violates the ACM Code of Ethics [5].

By uploading your files to Google services, you surrender to Google the right to use files as they please, as stated by Google’s Terms of Service. However, the ACM specifies that users should know how their data is being used [1]. The title of the webpage for Google Drive is “Personal Cloud Storage & File Sharing Platform,” with the word “Personal” having a connotation of privacy. Google’s Terms of Service is irrelevant when most users are oblivious to what it contains. Users understand what is made most clearly available to them, and a claim of “easy and secure access to your content” gives the impression that the content is yours, not Google’s. However, Google Photos is not only a storage service but also a file sharing platform. Should users still maintain their right to privacy when they begin sharing their photos with others? What about if they create a public link? When the user shares files publicly, the expectation of privacy is lost. When CSAM and other illegal content is distributed through public links that point to Google Photos, the action taken by Google is entirely justified because the user is using Google Photos as a means of distribution rather than solely a means of storage.

This scenario raises another question about Google’s involvement: should Google, and big-tech companies in general, take an active role in enforcing the law and preventing harm? The IEEE Computer Society’s Code of Ethics states that “the ultimate effect of the work should be to the public good” [4]. Based on this condition, Google is doing a great job – ethically speaking – as CSAM is against the public good. Additionally, upholding the public good should be a primary concern when designing a software project. Google is taking an active involvement in CSAM prevention. They have employees dedicated to this work and have delegated much funding on AI research and development. They have gained public support because their cause is deemed noble.

But, what about when the “public good” is not so publicly agreed upon and poses questions of legality against questions of morality? For example, what if Google started having an AI scanning text messages for signs of drug deals, domestic abuse, or plans of political demonstrations? Yes, Google may prevent crime, but are they acting for the public good? When companies like Google show this capability and get involved in issues of legality, they open themselves up to questions about why they aren’t taking more action towards other causes that might create just as much public harm. Unfortunately, there are no right answers, and the solutions to these problems remain unknown, which is why healthy discussion on tech companies’ involvement in harm prevention is needed.

Finally, even after being cleared by his local police department of wrongdoing, Google still refused to reinstate Mark’s Google account. Google provides countless services, from storage and email to backend web development and YouTube channels. All of these services are tied to one user; if a user is suspended from their account, they can no longer access any of these services. Technically, Google should have no legal obligation to reinstate Mark’s account after being cleared of legal wrongdoing. After all, Mark was found in violation of Google’s Terms of Service, so they should not have to reinstate him if they choose not to. However, even though they do not have to reinstate Mark legally, they should still reinstate him based on morals. In this case, locking users out of their accounts before determining their guilt gives the impression that Google is acting as a judge and jury while toying with people’s digital livelihood.

References

1. “ACM Code of Ethics and Professional Conduct.” ACM, https://www.acm.org/code-of-ethics.

2. Bhuiyan, Johana. (2022, August 22). Google Refuses to Reinstate Man’s Account after He Took Medical Images of Son’s Groin. Guardian News and Media. https://www.theguardian.com/technology/2022/aug/22/google-csam-account-blocked.

3. Hill, Kashmir. (2022, August 21). A Dad Took Photos of His Naked Toddler for the Doctor. Google Flagged Him as a Criminal. The New York Times, https://www.nytimes.com/2022/08/21/technology/google-surveillance-toddler-photo.html.

4. IEEE Computer Society: Code of Ethics. IEEE Computer Society Code of Ethics, https://www.computer.org/education/code-of-ethics.

5. “Universal Declaration of Human Rights.” United Nations, United Nations,https://www.un.org/en/about-us/universal-declaration-of-human-rights.

6. “Personal Cloud Storage & File Sharing Platform.” Google, Google, https://www.google.com/drive/.