Legal Issues

by Tim Cushing


Filed Under:
child porn, playstation

Companies:
sony



Court Points Out Numerous Ways Using Playstation Network To Trade Child Porn Is A Bad Idea

from the doing-a-terrible-thing-badly dept

Some Playstation Network users tried to use Sony's messaging system to transfer child porn back and forth. The ad hoc Playstation Playpen was reported by users, and Sony went digging into their messages and discovered illegal images, which it then -- as it is statutorily required to do -- turned this information over to law enforcement and reported it to NCMEC (National Center for Missing and Exploited Children). Unsurprisingly, this led to the arrest of one of those trading illegal images.

So far, there's nothing surprising about this chain of events, much less the court's denial of the defendant's motion to suppress. What is surprising is the court's claim that the Fourth Amendment doesn't protect PSN users' data and communications.

If you have any legally incriminating information sitting in your PSN account, don't count on the Fourth Amendment to protect it from "unreasonable search and seizure" by Sony without a warrant. A district court judge in Kansas has ruled in a recent case that information Sony finds has been downloaded to a PlayStation 3 or a PSN account is not subject to the "reasonable expectation of privacy" that usually protects evidence obtained without a warrant.

While this summation is mostly correct, the fact is that child porn is something actively policed by every service provider and whose terms of service specifically warn users against trafficking in illegal content. Even more specifically -- as is pointed out in the decision [PDF] -- users are told Sony will monitor communications and uploaded content if it feels the need to do so.

there is no requirement or expectation that [Sony] will monitor or record any online activity on PSN, including communications. However [Sony] reserves the right to monitor and record any online activity and communication throughout PSN and you give [Sony] your express consent to monitor and record your activities . . . Any data collected in this way, including the content of your communications, the time and location of your activities, your Online ID and IP address and other related information may be used by us to enforce this Agreement or protect the interests of [Sony], its users, or licensors. Such information may be disclosed to the appropriate authorities or agencies.

In this case, PSN moderators were tipped off by PSN users. This is one form of "private search," in which users spotted something violating the Terms of Service and passed it on. Sony has a legal obligation to report suspected child porn to law enforcement, so it accessed the reported accounts. This is another "private search" -- one that's completely lawful, provided for by terms agreed to by the PSN users, and, honestly, something that's so far from unexpected as to provoke wonder about the arrested user's overall experience with the internet in general.

What it isn't, however, is any sort of indication that certain user communications or data are not protected by the Fourth Amendment. There's a certain amount of data that falls under the Third Party Doctrine, which isn't subject to the Fourth Amendment. But to obtain the content of communications, or access files stored by users, the government would most likely still have to seek a warrant.

This differs from the Best Buy Geek Squad cases in that there's no evidence of an ongoing relationship between law enforcement and Sony where moderators are paid (or prompted) to seek out evidence of illegal activity, acting as a warrantless proxy for the government that violates the spirit -- if not the letter -- of the "private search" exception.

The defendant tried arguing that NMCEC's search of the files sent to it by Sony was not a private search and violated his Fourth Amendment rights. The court takes a look at the case cited (one we covered here previously) and finds NMCEC's search did not exceed the scope of the private search. Whether or not it acted as a government agent, it did not perform an unconstitutional search.

In Ackerman, AOL’s filter identified one of four images attached to the defendant’s email as child pornography. Id. As soon as AOL identified the hash value match, it forwarded the email in a report submitted to NCMEC. Id. The NCMEC analyst viewed the email and the four image attachments and determined that all four of the attached images—not just the one that AOL’s filter had identified—qualified as child pornography. Id. So, Ackerman’s undisputed facts established that NCMEC opened and viewed information other than the image that was the target of AOL’s hash value match and “that AOL had not previously examined.” Id. at 1306–07. NCMEC had exceeded, and did not merely repeat, AOL’s private search and the Circuit thus held that NCMEC had violated the defendant’s Fourth Amendment rights. Id.

But here, the facts differ. No evidence even suggests that NCMEC exceeded the scope of Sony’s private search. Indeed, the logical inference the court draws from the undisputed facts is that NCMEC’s review did not exceed Sony’s private investigation. Mr. Meininger testified that Sony does not use a hash value matching system. It follows that all of the information Sony sent NCMEC was first reviewed by a Sony employee. Mr. Meininger testified that the Sony Moderation Team “use[s] human eyes” to review every grief report it receives. So, when the Sony Moderators received the initial grief report about Susan_14 on June 6, 2012, a Sony Moderator opened the report and viewed the message and attached image. The court finds that NCMEC did not exceed the scope of Sony’s private search when it reviewed Ms. Kawaguchi’s August 8, 2012 report and found that it did not include child pornography.

Now, the court does make the case that the user's agreement to Sony's Terms of Service somehow strips away privacy protections for PSN account holders. It can be argued, as the court does here, that agreeing to these terms means knowingly giving up your expectation of privacy. But there's still a lot of ground to be covered between Sony's statutorily-required reporting of suspected child porn and the government calling up Sony and making warrantless demands for users' communications and data. That really isn't explored in this opinion as it's not part of the underlying case.

The government did obtain a warrant to search the contents of the PS3 owned by the suspect -- something the court says has a "reduced" expectation of privacy thanks to the user's agreement with Sony's terms of service. Nowhere does the court say the expectation of privacy is eliminated entirely by the terms of service. It only says the following, and what it does say isn't written as a clear-cut determination.

The agreement also warns users that they must not use the PSN to violate any local, state, or federal laws, and that any information Sony acquires while monitoring the users’ activities may be turned over to appropriate law enforcement authorities. This agreement seemingly prevented defendant from having a reasonable expectation of privacy in information he stored on his PS3 device.

What did fall under the Third Party exception -- and the private search exception -- were the files reported to Sony, which then reported them to NMCEC and law enforcement. At no point does this chain of events suggest Sony views users' expectation of privacy in the same light the court ("seemingly") does. (The FBI doesn't view it this way either, as it obtained a warrant to search the contents of the suspect's PS3, and law enforcement tends not to get a warrant unless it absolutely has to.) The court's reading of the Fourth Amendment is limited to this case and some roughly-analogous precedent. But while it leans towards an interpretation of the Third Party Doctrine that would cover almost anything that touches Sony's Playstation Network (including files downloaded via the network), it doesn't go so far as to suggest all of it can be had without a warrant.

It also goes off on a tangent suggesting there's no expectation of privacy in communications because the contents are disclosed to the recipient... but that's clearly a completely wrong interpretation of the expectation of privacy and warrant requirements in general. Warrants still need to be sought to obtain the content of emails, etc. in most cases, no matter what sort of monitoring users agreed to when they opened their accounts. It's kind of a sloppy decision that builds on some sloppy defense arguments and reaches critical muddle at this point. At any rate, the decision will be appealed, which will hopefully clean up the district court's questionable Third Party reasoning, but is unlikely to find Sony's private search a violation of the Fourth Amendment.

Monitoring networks for child porn has been around for decades. Anyone asking for or distributing child porn using a third-party messaging service is basically begging for a visit from the FBI. It plays right into the most well-known and widespread "private search" there is: the statutory requirement for platform owners to report suspected child porn to the government.


Reader Comments

Subscribe: RSS

View by: Time | Thread


  • identicon
    I.T. Guy, 30 Jan 2017 @ 12:31pm

    Why do we act as if there is a shred of the fourth left? (Or second or first for that matter.)

    reply to this | link to this | view in chronology ]

    • identicon
      Anonymous Coward, 30 Jan 2017 @ 1:07pm

      Re:

      Do you have a specific objection in this particular case?

      reply to this | link to this | view in chronology ]

      • identicon
        Anonymous Coward, 30 Jan 2017 @ 7:47pm

        Re: Re:

        I hope you are falsely accused of CP with the data taken without a warrant combined with parallel construction. You would so fucking deserve it.

        I bet your fucking ass will be singing a completely different toon. We should always object to abusing someones rights for very damn good reasons!

        I will never trust again when government says they found CP on someones machine.

        reply to this | link to this | view in chronology ]

  • icon
    GristleMissile (profile), 30 Jan 2017 @ 12:57pm

    This is kind of off-topic, but why the heck is The National Center for Missing and Exploited Children initialized as NMCEC? Shouldn't it be NCMEC?

    And I'm not even sure it's an error on your part, since a quick search shows FEMA calling it the NMCEC.

    reply to this | link to this | view in chronology ]

  • icon
    ECA (profile), 30 Jan 2017 @ 1:24pm

    PERSONAL PRIVACY

    is not involved as SOON as a 3rd party is involved..
    There is only 1 Business that is REQUIRED to keep your DATA safe...the MAIL..NOT UPS, NOT FED EX...

    reply to this | link to this | view in chronology ]

    • identicon
      Anonymous Coward, 30 Jan 2017 @ 1:34pm

      Re: PERSONAL PRIVACY

      I refuse to accept that I cannot have a private three way conversation, or that the government has a right to snoop on my messages just because they're stored on a third party server.

      I can, however, accept that my PlayStation messages might not be private if PlayStation tells me in advance that they might not be private.

      reply to this | link to this | view in chronology ]

      • identicon
        Anonymous Coward, 30 Jan 2017 @ 7:52pm

        Re: Re: PERSONAL PRIVACY

        There is a reason they call it the 3rd party doctrine.

        As private citizens everything we, will in one form or another, interface with a 3rd party no matter how hard you try to avoid it. Since you cannot bank, get utility services, or pretty much do anything really with a 3rd party there is a global mindset that government is okay to get that data without a warrant.

        reply to this | link to this | view in chronology ]

      • identicon
        Anonymous Coward, 31 Jan 2017 @ 1:03am

        Re: Re: PERSONAL PRIVACY

        I refuse to accept that I cannot have a private three way conversation

        In many countries, a conversation with two people has the statistical probability that at least one person has a reporting relationship with a government enforcement agency. A conversation with three people has a higher probability.

        The unfortunate thing is that in the US, this holds true as it does in Syria, Iran, Saudi Arabia, China, and Russia. An acquaintance of mine from Rominia repeats a tale of a brother speaking to his sister in unflattering terms about Ceausescu. He was murdered by the secret police within the week. Obviously from this remove I can't say it was the sister that reported him, but my acquaintance is convinced of it. That doesn't mean it's true, but ...

        In the day an age of "See something, say something", and the petty minded that are legion, I'd say that speaking your mind too clearly against the penultimate and current US rulers has at least the potential to become somewhat uncomfortable.

        reply to this | link to this | view in chronology ]

  • identicon
    Anonymous Coward, 30 Jan 2017 @ 3:10pm

    It's a typo on Tim Cushing's part. In the very 1st paragraph, he types it correctly as NCMEC, but then in the paragraph immediately following "Geek Squad cases", he types it as NMCEC, twice. The quoted text following that paragraph has it typed correctly as NCMEC nine times, but may just be a copy/paste.

    reply to this | link to this | view in chronology ]

  • icon
    GristleMissile (profile), 30 Jan 2017 @ 4:25pm

    This is yet another case where should and do strongly diverge. We should be able to expect privacy in all our communications, no matter whether a third party is involved. That shit's a government cop-out by people with no respect for the constitution nor the ideals it helps codify.

    reply to this | link to this | view in chronology ]

  • identicon
    Digitari, 31 Jan 2017 @ 12:36am

    Well

    Does this mean the DNC emails are all good? They did come from a third party, right?

    reply to this | link to this | view in chronology ]

  • icon
    Ninja (profile), 31 Jan 2017 @ 2:36am

    Just struck me but imagine if there wasn't CDA immunity to protect services such as PSN. And Sony is behind the copymorons trying to destroy these protections. Imagine their execs being arrested because they allowed CP into their network. Now tell them the same story and say it was in Google results to see how fast they call for executive heads.

    reply to this | link to this | view in chronology ]

  • identicon
    Chopp Curitiba, 31 Jan 2017 @ 8:14am

    Chopp Curitiba

    It's Chopp the public records Schrödinger's box, where requested documents lie in a dual state of existence and nonexistence

    reply to this | link to this | view in chronology ]


Add Your Comment

Have a Techdirt Account? Sign in now. Want one? Register here
Get Techdirt’s Daily Email
Use markdown for basic formatting. HTML is no longer supported.
  Save me a cookie
Follow Techdirt
Techdirt Gear
Shop Now: I Invented Email
Advertisement
Report this ad  |  Hide Techdirt ads
Essential Reading
Techdirt Deals
Report this ad  |  Hide Techdirt ads
Techdirt Insider Chat
Advertisement
Report this ad  |  Hide Techdirt ads
Recent Stories
Advertisement
Report this ad  |  Hide Techdirt ads

Close

Email This

This feature is only available to registered users. Register or sign in to use it.