138 lines
6.7 KiB
Markdown
138 lines
6.7 KiB
Markdown
# Support and content-removal operations
|
|
|
|
Status: implemented intake and operator workflow. This document describes the
|
|
software behavior; it is not a legal opinion and does not establish that a
|
|
particular law applies to the operator.
|
|
|
|
## Separate queues
|
|
|
|
Who Need Help deliberately separates three mechanisms:
|
|
|
|
1. An authenticated in-product report targets exactly one request, assignment,
|
|
message, Activity, or Activity message and follows the existing audited
|
|
trust-and-safety workflow.
|
|
2. A support request covers account access, technical issues, safety concerns,
|
|
moderation appeals, privacy questions, data export, and account deletion.
|
|
3. A content-removal notice covers a precise item alleged to be illegal or to
|
|
infringe a right. TAKE IT DOWN notices have a dedicated public form and a
|
|
separate regime value in the removal queue.
|
|
|
|
The operator workspace is `/support/operations`. It is protected by the same
|
|
database-checked moderator or administrator authorization as the existing
|
|
moderation workspace. Every creation and decision records an audit event.
|
|
|
|
## Public routes
|
|
|
|
- `/support` — ordinary support.
|
|
- `/account/delete` — external account-deletion request path suitable for use
|
|
as the Google Play account-deletion web resource.
|
|
- `/legal/content-removal` — general electronic notice-and-action intake.
|
|
- `/legal/take-it-down` — dedicated intimate-visual-material removal intake.
|
|
|
|
The request and Activity screens link to the general form with the exact local
|
|
content URL prefilled. Only same-origin relative paths can be prefilled this
|
|
way. The server validates one complete HTTP or HTTPS URL per line and accepts
|
|
at most 20 locations in one notice.
|
|
|
|
## Contact verification and status access
|
|
|
|
Public submissions display a reference but never expose the signed status token
|
|
in the redirect. The private status link is sent to the contact email. Opening
|
|
it marks that contact address as verified. An authenticated submission uses the
|
|
confirmed account email and is verified immediately.
|
|
|
|
Email-link verification establishes access to the mailbox, not government
|
|
identity, authority to act for another person, or the truth of the claim.
|
|
Operators must perform any additional verification appropriate to the requested
|
|
action. In particular, an account-deletion request must not be fulfilled against
|
|
another person's account merely because an address was typed into the form.
|
|
|
|
Identity and contact fields may be omitted from a general report of sexual
|
|
material involving a minor. Such a report still receives an urgent queue state,
|
|
but no status email can be sent without a contact address.
|
|
|
|
## TAKE IT DOWN boundary
|
|
|
|
The dedicated form accepts exact URLs and textual identification only. It does
|
|
not accept file uploads and explicitly tells the submitter not to reproduce or
|
|
email the intimate image or video. A submitted notice is marked for urgent
|
|
review and records a review due time 48 hours after receipt.
|
|
|
|
The current product does not accept user-uploaded images or videos. The presence
|
|
of this preparedness workflow therefore does not claim that Who Need Help is a
|
|
covered platform, that a submitted item satisfies the statutory definition, or
|
|
that identical-copy detection exists. If media hosting is added, the operator
|
|
must review the then-current law, implement safe media hashing and
|
|
identical-copy handling where applicable, and test the entire removal path
|
|
before enabling uploads.
|
|
|
|
The primary US text currently requires a clear and conspicuous process and, for
|
|
a valid request to a covered platform, removal of the depiction plus reasonable
|
|
efforts concerning known identical copies as soon as possible and no later than
|
|
48 hours:
|
|
|
|
- <https://www.govinfo.gov/content/pkg/COMPS-18158/pdf/COMPS-18158.pdf>
|
|
|
|
## EU electronic notices
|
|
|
|
The general form captures the elements listed in Article 16 of Regulation (EU)
|
|
2022/2065: a reasoned explanation, exact electronic location, submitter name and
|
|
email subject to the child-sexual-abuse exception, and a good-faith accuracy
|
|
statement. It sends an acknowledgement when email is available and sends the
|
|
recorded decision after a verified-contact operator update.
|
|
|
|
- <https://eur-lex.europa.eu/eli/reg/2022/2065/oj/eng>
|
|
|
|
Product implementation alone does not determine the service's legal
|
|
classification, establishment, target markets, applicable national law, or
|
|
redress obligations. Those remain launch decisions requiring jurisdiction-
|
|
specific review.
|
|
|
|
## Email and operator notification
|
|
|
|
`EMAIL_FROM_ADDRESS` remains the outbound sender. Optional
|
|
`SUPPORT_INBOX_ADDRESS` has two separate effects:
|
|
|
|
- outgoing support/removal messages use it as `Reply-To`;
|
|
- it receives a metadata-only alert containing the reference, queue type, and
|
|
protected operator URL when a case is created.
|
|
|
|
The alert intentionally excludes the free-text report and reported URLs. The
|
|
full record remains in the protected database queue. If the variable is empty,
|
|
intake and reporter acknowledgement still work, but no operator inbox alert is
|
|
sent. The configured inbox must be monitored operationally; the application
|
|
cannot prove staffing or response availability.
|
|
|
|
## Account deletion and data export
|
|
|
|
The web application and Android WebView expose the account-deletion request from
|
|
account settings, and the public `/account/delete` route remains usable after an
|
|
app is uninstalled. The workflow verifies the contact and creates an audited
|
|
account-lifecycle request.
|
|
|
|
Actual erasure/anonymization and export are not automated because the operator
|
|
has not yet selected a jurisdiction-specific retention policy for safety,
|
|
fraud, disputes, and legal records. An operator must not mark a request resolved
|
|
until the applicable data action has actually been completed and communicated.
|
|
Before public launch, legal review must define which linked records are erased,
|
|
anonymized, or retained and for how long; only then should a destructive
|
|
execution routine be implemented and tested against backups and relational
|
|
constraints.
|
|
|
|
Google Play's current policy requires both an in-app path and an external web
|
|
resource when an app allows account creation:
|
|
|
|
- <https://support.google.com/googleplay/android-developer/answer/13327111?hl=en>
|
|
|
|
## Abuse controls and operational limits
|
|
|
|
`support_request` and `content_removal_notice` are supported names in the shared
|
|
PostgreSQL rate limiter. As with the other actions, no numeric policy is enabled
|
|
unless the operator supplies measured values through
|
|
`RATE_LIMIT_POLICIES_JSON`. CSRF protection, validation, exact URL limits,
|
|
contact verification, staff authorization, and audit events apply regardless.
|
|
|
|
The software does not provide emergency response. Threats to life or safety are
|
|
prioritized in the queue, while every public safety screen continues to direct
|
|
people in immediate danger to local emergency services.
|