Android Auto-Backup Uploaded Files You Never Chose to Upload.

How Android’s Auto-Backup Works

Android’s backup feature is designed to simplify the process of saving files to the cloud. The feature is categorized by content type, and if users have it enabled, the backup feature will automatically upload new photos, documents, and videos to the cloud as they become available. Instead of necessitating an action on an individual file basis, the feature enables a set of types of content to be automatically uploaded to the cloud.

Google’s Scan and the Implications of Cloud Backup

Once they reach Google’s servers, backed-up images (and other files) are scanned by Google to ensure they are not being used for anything that might violate their Terms of Service. If a scan reveals an image that Google believes is prohibited, such as an image depicting child abuse, the account’s owner may be at risk for account termination, and Google may report the user to the relevant authorities.

Criminal Guilt vs. Account Termination

It is important to understand that account termination by Google does not equal an admission of criminal guilt. The standards of evidence required to establish guilt in a criminal investigation are far higher than the standards required for a provider to terminate an account. Google’s AI does not always get it right, and mistakes can lead to criminal reports and federal investigations, even for innocent users who have no intention of committing a crime.

Scanned Images That Were Never Deliberately Selected for Upload

In some cases, users may be unaware that their phones are automatically uploading photos that they did not intentionally select. Even if users never chose to backup images, the cloud scanning process still applies. For example, a widely reported 2022 case involved medical images automatically uploaded to the cloud by a phone’s backup feature, leading to a San Francisco Police Department investigation in California.

Why did Android upload files I never selected?

Are Android Auto-Backup and Google Photos Different?

While they both operate using Google’s cloud servers, Android’s Auto-Backup and Google Photos are separate services that users configure separately. Android Auto-Backup saves users’ data on the cloud server as an archive for a future restore if necessary. Google Photos, conversely, is a more direct method of storage.

Android device backup can include information such as app data, call history, contacts, settings, SMS messages, etc., but images, videos, and other media files themselves are not included in the archive. The Android backup does, however, include the data related to which folders on the device are marked to upload images and videos to the cloud.

The device backup is not Google Drive, either. The backup is used specifically as an archive that may be used to restore some of the data after the device is reset to its default settings. To use Google Drive, users must manually select their images and upload them to the storage service.

Therefore, it is possible to have Google Drive, Android Auto-Backup, and Google Photos enabled and disabled independently.

Do Android Phones Enable Google Photos Backup by Default?

Android does not automatically enable Google Photos backup. Currently, when users sign up for Google Photos on their Android device, they must go through an onboarding process to choose their backup and other preferences. If a user enables backup here, Google Photos will begin backing up all existing photos, and any new photos that get created on the device moving forward. If the user disables backup here, Google Photos will not automatically upload photos, and the user must instead manually select any image they wish to upload.

Some device manufacturers do not enable Google Photos by default, or they include additional restrictions on onboarding. Other manufacturers include a Google Photos option in their settings menu or pre-install the app. Depending on these variations, users may be unaware of Google Photos, and/or they may have enabled it at some point during the initial setup of their Android device.

How Android Users Can Upload Additional Folders

Users who have Google Photos backup enabled for their entire photo gallery can choose to backup other device folders as well. These include folders with images such as Instagram images, WhatsApp images, etc. When users choose to backup additional folders, those folders’ contents will be added to their backup settings and be subject to the same auto-backup upload and scan as photos from the camera folder.

Similarly, some messaging apps can be configured to automatically download photos and videos. If a user has enabled backup for a folder that contains downloaded media from a messaging app, the app can automatically upload any new images it downloads to the cloud. Even if the user never deliberately selects a photo or chooses to upload the photo to the cloud, the cloud scanning process still applies.

How can I check what Google actually uploaded?

How Can I Check My Backup Status in Google Photos?

Users can check their backup status in Google Photos by choosing their account profile from the top-right corner of the application and navigating to the menu. Here, they will find information on their device’s backup status. This information only indicates whether images, videos, and documents are being actively uploaded from the device. It does not provide information about what has been uploaded, nor does it provide an audit trail.

How Do I Know Which Photos Were Backed Up to the Cloud?

Unfortunately, there is no audit trail within Google Photos to prove to users what content they have uploaded. Users can, however, use Google Takeout to export and see the Google Photos library that resides on Google’s cloud servers. This will allow users to determine if Google has images and videos in the cloud that they chose to backup.

Google Drive activity does not serve as an audit trail for Photos uploads, since Google Drive is a separate storage service with separate upload mechanisms.

The Google Account’s “Your Devices” page identifies devices to which the user’s account has been signed in. This information confirms that the user has signed in to an Android device but does not provide proof of what content was automatically backed up from the device to the cloud.

What Happens if I Use a Different Google Account?

If you use a different Google account on your device, then you will have a new Google Photos library for that account. Photos and other files being backed up from your device will be uploaded to the second account’s library. However, unless you sign out of the first account, both accounts will be active on your device, and images and videos could continue to be backed up to the first account’s library as well.

Even if you signed out of a previous Android device, that device can still upload content if your account is still active on the device and the device is still set to backup to the cloud.

What Happens if I Disable My Backup Settings or Delete a Device Copy of an Image?

If you disable your Google Photos backup settings, the images and videos that remain in the cloud will stay in the cloud. Google will store these copies until you delete the copies in the cloud, at which time they will no longer be subject to Google’s cloud scanning and the possibility of triggering a criminal investigation.

Similarly, deleting a device copy of an image does not necessarily delete its cloud backup copy, so users who delete images from their devices must be certain that they have also deleted any cloud copies of the image.

What Happens After Google’s AI Flags a Backed-Up Photo?

Once flagged, a photo may be compared against a database of known material. There are two types of hash-matching systems Google may use for this comparison. A cryptographic hash match is an exact match between file bytes, while a perceptual hash match is a match based on visual similarity. Cryptographic hash matches are extremely accurate, while perceptual hash matches can misidentify visually similar but non-identical content. An AI classifier can identify content not present in a database by predicting what content is present.

Despite the accuracy of some hash-matching systems, it is rare for Google’s AI to generate reports based solely on a single, automated alert. Typically, the system will trigger human review of the content to ensure that reporting is warranted. However, mistakes can still be made, and innocent content can be flagged by these automated systems.

Importantly, when Google reports suspected or actual illegal content, it does not have to prove to the Department of Justice (DOJ) that its report is accurate. Rather, it may be sufficient for the images and videos at issue to merely appear to depict violations of federal law.

When Does Google Have to Report?

Under 18 U.S.C. § 2258A, Google must report content to the CyberTipline when it is acquired “actual knowledge” that such content represents “apparent violations” of federal law. This statute applies only when Google is aware of illegal content, not necessarily when an automated alert is triggered. For more information, contact a California cyber-crime defense lawyer.

What Kind of Information Do Reports to CyberTipline Contain?

Google reports suspected violations to the National Center for Missing and Exploited Children’s CyberTipline, which it is required to do in certain circumstances under 18 U.S.C. § 2258A. Reports to CyberTipline can be very detailed, and Google will typically include everything it can. For example, reports can include:

• The flagged image or video, or multiple flagged images and videos
• The user’s account identifier, username, email address, and other information Google has on file
• The date and time of the backup upload
• The IP address and geographic location of the upload

However, the information included in a CyberTipline report can vary, and not every report will contain all of this information. Once content is reported to the CyberTipline, the DOJ can initiate an investigation based on the information Google provided. The CyberTipline report can then serve as the foundation for a federal grand jury subpoena or even a search warrant. This is why it is important for users to know what information they may have uploaded, and to a federal agent, it may look like incriminating evidence.

Spodek Law Group, led by managing partner Todd Spodek, defends clients in federal criminal and white collar matters.

Does Automatic Backup Prove Knowing Possession or Intentional Receipt of Prohibited Content?

Simply receiving a CyberTipline report from Google does not establish knowing possession or criminal guilt. The mere presence of an image in the cloud does not mean that a user intentionally accessed, knew about, or controlled that image. This is especially true in cases where images were automatically uploaded from an Android device.

If a user is facing federal charges for possession of an image, video, or other material, the government must prove that the user knowingly possessed the material in question. This usually means proving both knowledge of the material and either actual or constructive possession of it. However, with automatic backup and cloud scanning, it is entirely possible to prove that an image is in the cloud without proving knowledge, access, and control.

The statute that criminalizes knowing possession is 18 U.S.C. § 2252A, and it separately criminalizes knowing receipt. Again, receipt alone does not equal possession, and possession alone does not equal receipt. However, both can be subject to prosecution under the same federal statute.

What Constitutes Knowing Possession?

Possession under 18 U.S.C. § 2252A can take two forms: actual possession and constructive possession. Actual possession is clear, the user has physical possession of the image, video, or other material. Constructive possession is a concept that exists in both state and federal criminal law; it is the legal equivalent of physical possession and implies that a person has knowing power and intention to control the material in question.

In the context of a cloud upload, the government must prove that the user had knowing power and intention to control the image or video. For many users, this may be difficult to prove, because they may be entirely unaware of a cloud upload or an image they did not choose to upload.

What Constitutes Illegal Visual Depictions?

When analyzing an image, video, or other visual depiction for whether it constitutes a federal offense under 18 U.S.C. § 2252A, the DOJ must establish that the content contains illegal sexually explicit conduct, and they will apply the six-factor Dost analysis to determine this. Under 18 U.S.C. § 2256, this will include a determination whether the image depicts child nudity as sexually explicit conduct.

Importantly, 18 U.S.C. § 2256 contains no medical exception; instead, courts applying the Dost factors have generally found that nudity photographed for a genuine medical purpose is not a lascivious exhibition. Images that are also medical photos in nature may fall under the same exception as images depicting a child during a diaper change or other aspects of basic childcare.

Does the Time of a Cloud Upload Matter?

The date and time of a cloud upload can be relevant in determining if a user’s image or video, if presented to them, satisfies the statutory elements of a federal offense. For example, if the upload timestamp is the same as the original capture timestamp, it is much more likely to be viewed as a voluntary upload to the cloud. If, however, the upload timestamp differs substantially from the original capture timestamp, it may be evidence of an automatic backup.

Can police search my phone or Google account without a warrant?

What happens after I receive a device-search warrant?

A device-search warrant is one of the most important steps in a criminal investigation; it only happens after a law enforcement agent persuades a magistrate that there is “probable cause” to believe that the device contains evidence of criminal activity. A magistrate is a federal court official and is tasked with reviewing warrant requests to determine whether there is probable cause. When a magistrate signs a device-search warrant, the FBI has legal authorization to seize the device and conduct a search.

What role does the Fourth Amendment play in a cloud investigation?

The Fourth Amendment restricts the government, and this restriction applies regardless of where or how a government agent obtained its evidence. As a result, when a government agent conducts a search based on information Google transmits to a government agency, the Fourth Amendment applies. Google’s automated scan is a private-company scan, and the Fourth Amendment does not restrict these types of scans. However, if a government agent examines more than the private search’s scope, the search may require a warrant.

In a 2018 decision, the U.S. Ninth Circuit Court of Appeals found that the government could review an image that had matched with child pornography. However, the U.S. District Court for the Central District of California went even further when it allowed the FBI to conduct a full review of other images that were not sent to the FBI. As a result of this overreach, the U.S. Ninth Circuit Court of Appeals ruled the warrantless review inadmissible, and the court’s ruling has implications for all cloud-storage device investigations involving the Fourth Amendment.

Is this different from the Fourth Amendment’s device-search warrant requirements?

Many users’ questions are answered by their understanding of the law as it relates to physical devices. In a 2014 decision, the United States Supreme Court upheld the Fourth Amendment’s warrant requirement in cases where devices were seized during an arrest. Generally, law enforcement must have a warrant to search your mobile device, unless it meets specific exceptions (which are rare).

When can police search my Google account without a warrant?

A different set of rules governs government access to your online account and electronic communications. 18 U.S.C. § 2703 addresses the types of records a government agent can compel a provider to disclose (by subpoena, warrant, etc.), and it divides the records into different categories based on the type of information they contain.

Basic subscriber information is information that identifies a user and includes basic account-related information. According to Section 2703(c)(2), basic subscriber information generally may be obtained through an administrative or grand-jury subpoena.

However, the Stored Communications Act (SCA) generally requires a warrant in order for the government to access communications stored in the cloud. In cases where law enforcement agents can compel disclosure of these communications without a warrant, this will likely only happen after a criminal defendant waives their right to contest the search.

What Should I Preserve Before I Delete Files or Seek an Appeal from Google?

If you learn of a government investigation after an encounter with law enforcement agents, do not delete files from your mobile device or other sources. In criminal cases involving images and videos, the DOJ may use a defendant’s decision to delete files after learning about an investigation to support an obstruction charge.

The fact that images, videos, or other files may have been presented to a federal agent should not determine whether to preserve a device copy. Preserving evidence that appears to be incriminating does not concede that you are guilty, and it certainly does not concede that you knowingly possessed the images, videos, or other files.

While a forensic copy of the device’s storage is most effective, preserving files in the directory path in which they were found is important. Recording the app database and the app that generated the file can help prove that a file is not a user’s.

Contemporaneous screenshots of your Google Photos backup settings are important. When you take a screenshot, you record what the interface displays at that time. The screenshot can provide evidence of how your backup settings were configured, which can rebut allegations that you knew about an automatic backup and intended to allow prohibited content to be uploaded.

What Should I Prepare to Submit with a Provider Appeal?

If a provider terminates your account based on a cloud scan, it is important to have a clear understanding of the images, videos, and other files involved in the alleged violations. Even though you may want to speak with the provider to restore your account, speaking with the provider without a defense attorney’s advice will be very risky. If you make statements to the provider, these statements are not protected by attorney-client privilege. With this in mind, it is important to share whatever information you have with a defense lawyer, and have the lawyer review your explanation before you submit the appeal.

Your defense attorney can help you determine whether to speak with the provider, how to speak with the provider, and what to do if the provider’s response or inaction warrants further action. In some cases, filing an appeal with a provider may be a necessary step to restoration. However, before you make an informed decision about your case, you will need to have an experienced Android device and cloud defense lawyer discuss the implications of an appeal with you.

Contact a Federal Criminal Defense Attorney

Nothing here is legal advice, and the details of your case matter. Todd Spodek and Spodek Law Group take federal criminal and white collar cases nationwide, from offices in New York, Brooklyn, Queens and Los Angeles. You can reach the firm at 212-300-5196.