But only Apple can, at least for now, scan content or your phone. Google cannot. Yet. Small, bit crucial difference.
People have certainly run afoul of the law when the data Google has about them is misused.
>Innocent man, 23, sues Arizona police for $1.5million after being arrested for murder and jailed for six days when Google's GPS tracker wrongly placed him at the scene of the 2018 crime
https://www.dailymail.co.uk/news/article-7897319/Police-arre...
We are only talking about what happens when you try to send the data to the cloud, after all. Not about all the data on the device.
None of this is true. A sibling comment describes the process:
>1. Only if you're uploading files are the files matched. 2. Only if the matches are very close are they considered matches. 3. Only if you have multiple very close matches is Apple able to decrypt the low-res versions of the images themselves. 4. Only if a human reviewer discovers any of the decrypted low-res images to be illegal content is any of your information shared with anyone else.
Google does reporting on how many National Security Letters requesting information about it's users that it responds to annually.
Why doesn't it just ignore them?
Apple does not have a legal obligation to install spyware on your phone (at least not in the US, not yet).
So does Apple[1]. Apple gave data on over 31,000 users/accounts based on National Security Letters in the first half of 2020 alone[1].
> Why doesn't it just ignore them?
In the first half of 2020, Apple provided data to the US government (non-FISA or NSL) about 9,000 times, and responded to requests for data with the data about ~85% of the time, and 92% in cases of "emergencies"[1].
2. What’s more important is you can reverse engineer algorithm that’s used locally to compare these hashes. Unlike with cloud-based searches other providers run, this puts significant limitations to what Apple or LEA can do on your phone. E.g. they can’t extract strings from PDF or grep through image metadata or request all images of certain users without knowing what these images would depict in advance. The frequency of hash database updates even if opaque will still provide more insight into what is being searched for compared to current status quo where public has zero insights because all search / aggregation queries are run on the server.
I get the arguments for why the fix for #2 is too dangerous to be worth it, but also get why they'd be inclined to choose it.