It wasn’t device scanning. A fingerprint of every photo was uploaded to the cloud as metadata for each photo. It’d be like being spooked if the title of the photo is uploaded to the cloud and examined for known csam titles.

And to make things more secure, the only way apple could read those fingerprints was if you uploaded 5 csam photos.

How is that worse than Google where engineers can look at every photo you upload regardless of the content as part of their server side scanning?

I took their argument to be that scanning at all was the problem. I may have misunderstood. I've made way too many comments today on HN, and I should most probably step away from the keyboard. In fact, I'm going to do that for real, my daughter just got home from school and I need to remember priorities.