[sxp]

https://www.theregister.com/2021/08/10/police_raid_man_for_d... is a better article with pictures.

The key bit is

> The raid by four Metropolitan Police constables took place after Southwark campaigner Robert Hutchinson was reportedly accused of illegally entering a password-protected area of a website.

> "I was searching in Google and found links to board meeting minutes," he told The Register. "Board reports, none of which were marked confidential. So I have no question that it was in the public domain."

So they're name dropping Google in the title for clickbait when the core issue is that the website didn't properly protect its data.

[capableweb]

> So they're name dropping Google in the title for clickbait

No, Hutchinson found the documents by searching on Google for the meeting minutes. The website might have protected the place where you found the link to the meeting minutes, but the meeting minutes themselves were hosted in a directory that not only was publicly accessible if you had the URL, but also allowed Google's crawler to access it and store it.

There is a slippery slope here, either way (if he gets free or if he gets sentenced), but none the less, Google is relevant to the case.

[mattmanser]

Police statement from the article:

He was taken into custody and later released under investigation. Following a review of all available evidence, it was determined no offences had been committed and no further action was taken

So they already dropped it.

[jzb]

“already dropped it”

That doesn’t make it okay. Being taken into custody is something I’d consider an overreaction and frightening for a person to endure. They should’ve looked into it before moving to pick them up in the first place. If the shoe was on the other foot- an activist claiming a developer broke in to obtain info- I bet police would’ve done more research.

[filoleg]

>That doesn’t make it okay. Being taken into custody is something I’d consider an overreaction and frightening for a person to endure.

Fully agreed. And not just that, the law enforcement officers seized his personal devices (phone + laptop) for 4 weeks and went through them.

Note: I am not sure if both phone+laptop were taken away for 4 weeks, but the article states that both were seized at one point, and explicitly mentions that the laptop was held for 4 weeks before being returned.

[TechBro8615]

I don’t know mate, even if there is only the potential for a dangerous crime, we need to keep these criminals off our communication infrastructure until we know for certain. Perhaps a better idea is a public/private partnership between all the big search engines, social media companies and police organizations who want to join and can pay dues.

Information sharing between members of the federation would reduce crime and spread of violent content. For example, when Google links a visitor to a harmful website, they can ping the local police with basic metadata about that user (could reuse the code from GDPR export). Google can lend its AI to categorize the alerts so local police know to be on the lookout for e.g. support for “The Big Lie” or local militia groups.

This way, the officers can stay aware of any potential threats to the safety of the children in their town, but maintain the ability to act proportionally and in context. Continuing with the example of a violent Google search, the alert might be a “P0”, but the police live in the same community as the suspect. If they’re not familiar with the data subject yet, they can use the alert to get a warrant for more information from Google. Or maybe they know the alert is a false alarm because the suspect is actually a government worker researching misinformation networks, so they instruct the AI to ignore alerts like it in the future.

We need to be on alert. With the proliferation of encryption, protecting citizens from harmful and increasingly dangerous information has never been more critical.

[zaphod4prez]

A Modest Proposal indeed, and so commonsensical it's a wonder it hasn't been implemented already!

[lenkite]

Would you still hold this opinion if all your personal computing devices are held for multiple weeks based on any arbitrary allegation and the record of your false arrest is available to all future employers ?

[rualca]

> Would you still hold this opinion (...)

I'm sure the post reads as satire.

https://en.wikipedia.org/wiki/A_Modest_Proposal

[mattmanser]

I personally think it's fair enough, the company probably claimed it was secure, therefore he must have hacked them. The police reacted, but when he could show it clearly wasn't secure and exposed to the public, they dropped it. And hopefully gave the company a private ticking off about wasting police time.

In the UK, an arrest under reasonable suspicion gives them the right to search your property for evidence, and to be honest they had reasonable suspicion, he had private company documents.

It's not like that company can cry wolf again, the police will be far more skeptical next time of their claims, having dealt with them before.

[trhway]

>I personally think it's fair enough, the company claimed it was secure, therefore he hacked them. The police reacted, but when he could show it clearly

it is absolutely not fair. The fair would be if the company had to show before the arrest that it was minimally secure. I mean they for sure had the HTTP transaction in their own logs - like GET document, response 200. They couldn't have reasonably in good faith claim "secure" and "hacking". What the company did is bordering on the false police report, and it would be fair if there were a recourse for the falsely arrested to use against the company.

[mattmanser]

Firstly, all those logs can be easily falsified and you're got absolutely no clue at all what that company showed to the police to convince them.

So get off your extremely manufactured high horse.

Secondly, even if you could somehow wave a magic wand and know the logs were real, you're approaching this as an expert and not as a layman.

A crime was reported, it was followed up, an arrest was made (maybe that means something different in America? It's just an arrest). No charges were levied, now the company that reported it look like fools in national news.

They'll not be pulling this shit again.

[rualca]

> So they already dropped it.

Don't you agree that's totally irrelevant? Being arrested for downloading a random doc from the internet is a real problem, so as monitoring dissidents to persecute them for any reason at all.

[corobo]

Yeah but the title makes it sound like Google Drive or something grassed him up. They weren't downloaded from Google, they were found using it

[seba_dos1]

...but that means Google has downloaded it earlier to index it. I guess Google should get raided as well.

[tehwebguy]

Google is super relevant to the case if they identified someone who downloaded a non-protected file in response to a police request. Not sure there is any slope left to slip on, this is basically the worst case scenario already I think.

Edit: Whoops, all of my assumptions were wrong!

[denton-scratch]

I beg to differ. I don't think Google is relevant.

As far as I can see, Google provided a search-result, which eventually (after Google's batted it around internally a few times) turns into an HTTP request to the CBS website, which resulted in password-free access to a public document.

So that will show up in the CBS webserver's access log; that's how they got the IP address. Nothing to do with Google.

Getting from the IP address to the person is messier; websearches, requests to ISPs, and presumably searches of activist databases the cops no doubt maintain might all have played a part.

My guess is the cops knew there was no case against him, because they tried the URL, and saw that there was no password challenge; but charged him anyway, because he was an activist, and they wanted to intimidate him.

[ChrisKnott]

He wasn't charged.

[denton-scratch]

You're right, he wasn't charged. He was "just" arrested.

[Maxburn]

I did not get that impression. The defendant said he used google to find these things, google did not snitch on him. He was in turn discovered by sharing them on social media.

[jsnell]

But we know from the article that's not how he was identified. Instead it was from the access logs of the company that he downloaded the file from.

> Hutchinson said his identification by Leathermarket and subsequent arrest raised questions in his mind, saying police confirmed to him that the company had handed over an access log containing IP addresses:

[LeifCarrotson]

The law must have a different definition of "password protected area" if it can be accessed without entering a password. It's like the people who get tickets for speeding or for going through a red light while their car is parked, because their street-side parking in front of their house is in the field of view of the license plate reader.

They're denying a tautology! A document is not password protected if you can access it without a password. A person not in a vehicle cannot commit a moving traffic violation. However, the automated computer system which issues those tickets does not actually comprehend those concepts, or any concepts at all. It merely follows rigid rules to send an alert on access to a particular file, or to issue a ticket with to the owner of the license plate number identified by the camera when a speed sensor returns a value not less than the speed limit (eg. NaN).

But who is the "they" who are denying those tautologies? As we abstract more and more to automated systems, it's important to remember that these systems are as dumb as a brick. A brick connected to the Internet and with very complicated melted sand inside, but a brick nonetheless. When decisions recommended by these bricks have significant consequences, it's important to keep a human in the loop.

[zoomablemind]

> ... the core issue is that the website didn't properly protect its data.

It seems that the bigger issue is that the activist was arrested by the police on supposedly only IP address evidence presented by the company/society.

Somehow the IP had to be linked to the person, probably a warrant should be needed for that too.

[throwthere]

That's not a bigger issue because the police simply had a warrant for the person who shared the documents. The first sentence of the article is:

> A man who viewed documents online for a controversial London property development and *shared them on social media* was raided by police after developers claimed there had been a break-in to their systems.

[zoomablemind]

Quoting from the article:

"...Hutchinson said his identification by Leathermarket and subsequent arrest raised questions in his mind, saying police confirmed to him that the company had handed over an access log containing IP addresses: "Now, how that ended up with me being in the frame, I don't know. There's part of this that doesn't add up..." ..."

[Maxburn]

They didn't even have that much evidence, google didn't participate in finding the defendant. He shared these docs on social media and was found that way.

[dang]

Ok, we'll change to that from https://www.bbc.co.uk/news/technology-58165478. Thanks!

[rexreed]

A Title change might be good too, because like others, I thought it was Google Docs snitching on a downloader.

A possibly more accurate title would be: "Activist raided by London police after downloading docs found on Google Search"

[dang]

Ah ok. Fixed. Thanks!

[ChrisKnott]

I would change "raided" to "arrested". The word "raid" is only used by El Reg and not any primary source. The account the arrestee gives in the BBC is "four police officers turn[ed] up at [my] door at 8:30" which suggests to me they just served him with a warrant and he let them in. Perhaps some people might call any execution of a warrant a "raid" but to me it suggests a forced entry.

[dang]

Ok, we've done that. Thanks!

[calvinmorrison]

> So they're name dropping Google in the title for clickbait when the core issue is that the website didn't properly protect its data.

The core issue is the government raided someones house for doing nothing wrong.

[shellac]

The police raided someone's house after a complaint. The government had nothing to do with this.

[calvinmorrison]

The government is entirely predicated on rule of law and the monopoly of violence imposed by police. Nice try though

[tpmx]

No, the core issue is the London Metropolitan Police being incompetent (and slow).

[gowld]

Not just incompetent, but callous and cruel toward the citizenry, making themselves agents of capitalist oppression.

[ryanlol]

There’s no reason to blindly believe every report of crime. In this case there probably wasn’t sufficient evidence on the victim’s side that any crime had happened.

[jdjdu]

How? By investigating a report of a crime, determining it was false, and releasing the guy?

[denton-scratch]

They charged him without any evidence. They were harrassing an activist. It wasn't incompetence.

[Edit: the article didn't say they charged him; I was wrong]

Well, that's how it looks to me, on the basis of a single report in a tech journal with a sort-of tabloid outlook. Maybe there will be more information in coming days.

[feu]

>They charged him without any evidence.

The article explicitly says that the police did not charge him.

[tssva]

No where in the article does it say they charged him with anything.

[denton-scratch]

I'm wrong - they didn't charge him. I don't know why I wrote that - I had read the article.

But they did arrest him.

[chrisseaton]

> They charged him

Eh?

[bmsleight_]

A British term, means formally charged with an offence. Police compile evidence and/or arrest a person. If the Police think there is enough of a case, the Crown Prosecution Service (CPS) decide if there is enough evidence to support a 'charge'

https://www.cps.gov.uk/cps/news/cps-says-role-cps-deciding-w...

Basically Police arrest, looked at the evidence then took no action as Police decided no crime - therefore not charged.

[dheera]

There is no reason to take the guy into custard for downloading a file, he didn't do anything violent, and should be allowed to stay home as long as he cooperates with the investigation.

Cooperative people accused of non-violent crimes should NEVER be taken into custody until proven guilty in a court with fair trial.

[mellosouls]

There is no reason to take the guy into custard for downloading a file

He was definitely in a jam

[jdjdu]

>Cooperative people accused of non-violent crimes should NEVER be taken into custody until proven guilty in a court with fair trial.

Uh, so if someone set fire to a bunch of homes in a neighborhood, and there's video of them doing it, but they did it knowing the homes were empty, they should just be left free until the trial is over? I'm sorry but I feel like a lot of online comments on criminal justice are very shortsighted

[unholythree]

A quick google search indicates arson is considered a violent crime in the US even though it is a property crime. I assume because of the high potential of injury or death. I do however agree with you that there are some property or financial crimes in which arresting a suspect would be warranted, especially if they had incentive to flee or intimidate potential witnesses.

[crimsoneer]

The reason will have been to secure any potential digital evidence. Could have done it with a warrant, but it's much of a muchness frankly

[raxxorrax]

I don't think this is name dropping and obvious that it wasn't sufficiently protected. These cases seems trivial, but they are certainly governmental abuse. In a perfect world, there would be consequences. Not for the officers but for those requesting the raid.

[CodeWriter23]

> So they're name dropping Google in the title for clickbait

We're talking about The Register here. Clickbait is foundational to their business model.