Didn't apple also recommend on-device scanning for these kind of pictures as well a while ago?
Glad to see they now oppose it but it's hard to gauge how sincere it is given their history of trying to implement it themselves.
Glad to see they now oppose it but it's hard to gauge how sincere it is given their history of trying to implement it themselves.
Breaking E2EE is their goal. CSAM is the McGuffin.
Why did you feel that the phrasing minimized it enough to miss the point?
In general I think it is better to not project some emotional reading onto other people’s posts.
https://en.m.wikipedia.org/wiki/Trauma_trigger
So it is obvious why somebody wouldn’t ask for more details on that sort of thing, right?
Maybe you are just using it to ask why they are annoyed, and weren’t aware of the specific definition that phrase?
In this case, it seemed like the phrasing was enough to distract them from a discussion that didnt need to be derailed
I was curious about why they felt compelled to take the thread that direction when the meaning was clear. They felt CSAM was being minimized when that was a red herring to the discussion.
Many (most?) people feel this viscerally, regardless of personal experience of parenthood or of abuse. This why the "think of the children" rhetorical gambit works.
In general, people like to believe in fairness, and dislike it when bad things happen to those who can't be said to "deserve" it somehow. Thus child abuse is more universally reviled than the rape of adults, because it's a lot harder to justify a child "deserving" that. (See also: kicking a friendly dog as a way to show off that a fictional villain is irredeemable.)
For a non-sexual example, remember how the pictures in this article provoked a surprising upswing in horror amongst even very anti-refugee people? https://www.theguardian.com/world/2015/sep/02/shocking-image...
And yes, csam is on the up and up.
> From March 2009 to February 2022, the number of victims identified in child sexual abuse material (CSAM) rose from 2,172 victims to over 21,413 victims. From 2012 to 2022, the volume of reports to the National Center for Missing & Exploited Children’s CyberTipline concerning child sexual exploitation increased from 415,650 reports to over 32 million reports.
See https://www.judiciary.senate.gov/press/dem/releases/durbin-i....
Also how about some numbers that aren't swayed by covid
What does covid have to do with the 10+ years of data I referenced? And even if the data does skew up during covid, how does that make it less of a problem?
if it's just some random kid and you have none of your own, such professions of selflessness might be more convincing
Snippet-- "I mean, back in March of 2009, the tools to track, find and report CSAM were in their infancy. Facebook didn’t start using PhotoDNA (which was only developed in 2009) until the middle of 2011. It’s unclear when Google started using it as well, but this announcement suggests it was around 2013 — noting that “recently” the company started using “encrypted “fingerprints” of child sexual abuse images into a cross-industry database” (which describes PhotoDNA)."
This is what I'm talking about with paranoid parents. I'm sick of your "save the children" bullshit
Edit-- I'll happily take the down vote on this, I understand the policy of extending charitable interpretation But I am genuinely confused which is why I asked for clarification, it was not rhetorical.
Was it someone daring to suggest that molesting a 3 year old is actually bad, like really bad?
I'd argue society would generally agree CSAM is unacceptable and we're allowing it right now. Many are quick to adopt the assumption that this law is an intentional and cleverly designed "attack on our rights to e2ee", as fact. If one can't recognize it's at least a poor attempt to balance the right to privacy with protecting kids, then I struggle to see how they're being honest with themselves.
I'm not arguing this law proposes the correct solution that should be adopted. I'm not arguing the surveillance state isn't licking their chops. I'm simply trying to point out that CSAM is a real problem. People really care about it. And it's factually wrong to claim otherwise.
It's also wrong and harmful to attribute motive based on assumptions. While you haven't done this, many others have. Instead of taking part in a constructive debate by arguing specific points, they try to paint a false motive on the opposition. "it's just so they can spy on you!" is roughly equivalent to "you view CSAM and that's why you don't want to protect our kids". These approaches are not how you reach a good solution that balances both sides of the argument. They're just throwing the oppositions legitimate concerns under the bus.
I'd also add, while e2ee is strong, unless you're verifying and compiling all the code you run on your device yourself, Apple/Google/etc still maintains the technical ability to snoop on you regardless of this law. I assume the bar to snoop on someone would most likely be lowered if laws like this are passed. But it's still technically possible (and likely happens).
Very nearly nobody is arguing otherwise, though.
> Apple/Google/etc still maintains the technical ability to snoop on you regardless of this law.
Absolutely. Not only can they, but they do.
How is equating CSAM to (merely) emotional weight not doing that?
I never argued it doesn't.
> Your entire argument is that since privacy measures are already loose then its okay to make them looser for "the children".
Where did I make this argument? (hint: I didn't)
The proposed solution to stopping child porn from being shared on these platforms would at most only do just that: Stop sharing on these specific apps. There are plenty of alternatives including encrypted zips, TOR etc. Breaking e2ee in WhatsApp would not do anything to stop sharing the material.
I don't think it's a leap to question why this is proposed when it could never achieve it's intended goal.
Yes you can decompile code. But reverse engineering is time intensive (I've done it). And these code bases are huge. It wouldn't be difficult to obfuscate some element of the code so it's difficult to detect. Especially if it's rarely triggered.
> The proposed solution to stopping child porn from being shared on these platforms would at most only do just that: Stop sharing on these specific apps. There are plenty of alternatives including encrypted zips, TOR etc. Breaking e2ee in WhatsApp would not do anything to stop sharing the material.
There is value in introducing barriers, even when imperfect. You must admit that, otherwise the fact that Google/Apple can ship an OS update whenever they want negates the entire argument in favor of e2ee.
Also, just FYI encrypted zips are easily brute forced.
> There is value in introducing barriers, even when imperfect.
Not when they are completely ineffective and introduce other issues.
It's is not nearly as big a problem as states wanting to oppress people.
Maybe there are ways to check our governments’ true commitment to safety in multiple areas and draw conclusions?
Environmental protection (we live in a period of climate collapse)? Food safety (sugar industry controlling legislation etc.)? Weapon licensing? Access to healthcare services and life-saving medications like insulin? Healthcare and social services for mothers and young children? Preferring diplomacy to aggression and acts of destabilization in politics?
Looking at all of this I conclude that, sadly, our governments don’t seem to care much about our or our children’s safety.
Looking at the efforts politicians put into staying into power and acting on personal or corruption-driven agendas… we’re not in great shape and I have the feeling that there may be some manipulation going on with intention to disrupt organizing, personal privacy, and the ability of individuals to communicate without being surveilled.
All authoritarian governments absolutely hate that - for reasons having nothing to do with the safety of their citizens.
It was a really interesting scheme that Apple clearly put a huge amount of thought into in order to maximise privacy. But people didn’t read the details and instead imagined it worked in a much simpler way, drowning out any useful conversation about what it was actually doing. The UK approach should be opposed, but I wouldn’t be opposed to the scheme Apple wanted to implement.
Only a matter of time before an authoritarian regime forced them to expand its scope. Create a Pandora's box and it will be opened.
This is incorrect. Last time it went to court, Apple used very different arguments.
> Now, there would be a way - once it's built it's built, there is no going back.
Then why is the British government not asking for the system Apple designed? They are asking for something far more intrusive. Apple’s system is irrelevant to that.
If you're just asking me, they bungled it. MacOS shouldn't have ever gotten stuck in the Windows 8 Software as a Service trap, because it radically redirected their trajectory from "well-made personal devices" to "golden handcuffs". Don't believe me? Just try to install a freedom-respecting OS on your iPhone. You can't. It's a goose-chase, because Apple insists they don't even make computers in the first place. It's an iPhone, running a very special superior version of UNIX you're not entirely allowed to look at, but you can trust is secure.
So of course an authoritarian regime can compel spying regardless. They've probably been doing it for the past decade, given what we know about FIVE EYES and PRISM. When you're a company like Apple or Microsoft, they just update the software with the requested backdoor/vulnerability installed and push it to the closed codebase. Even Apple's proposed E2E encryption could be backdoored. Nobody would ever know the wiser.
If you want the reason I'm mad, it's because it echoes the reasons I left the ecosystem with MacOS Catalina. The idea of Apple defaulting to you trusting them on so many things is kinda sickening. They've had the opportunity to build groundbreaking trustless systems with unparalleled openness and plausible deniability for all user data. Now the users are bartering for a better (but also closed) E2E system with a company that doesn't want to hear them out. It's not my jam, I'm not going to be held hostage by my computer because Apple has a fetish for making extreme decisions on the behalf of their users.
Fortunately Apple has abandoned that plan and now supports full end-to-end encryption for iCloud Photos. It’s still opt-in, but hopefully that will get easier in the future.
I don't buy this because everyone I know turns off iCloud Photos when it causes you to run out of your measly 5GB of free storage space, which makes the OS insistent about you fixing it to fix backups not uploading. For the people that do pay more, they keep iCloud Photos on specifically for the photo syncing aspect.
Similarly, I am not aware of any constitutional rule that prevents a private company like Apple from installing client-side software into your phone OS that scans the local photos on your private device even if you never upload them, as long they don't do the scanning at the government's direct behest and you give them permission by agreeing to their ToS.
The important constitutional principle here is "is this private company acting as an agent of the government." The important civil principle is: "do we, as citizens and customers, want our government and phone manufacturers to scan private files and submit automatic police reports." Once you've decided those questions, the physical/logical location of the files is a detail that only we nerds care about.
That having been said, given how they paraded their backdoor approach as a way to eat their cake and have it too, it's unsurprising that it attracted the attention of governments. They perhaps thought that implementing a scheme like this would put them ahead of the game, showing legislators they're self-regulating to work on these problems. In actuality, they're really just putting the future of digital privacy in dire straits.
Play stupid games, win stupid prizes.
Fucking thank you.
I have spent a lot of time in security. I spend a lot of effort on privacy. I keep abreast of the state of the art, I donate to the EFF. I spent a year auditing security at one of the largest cybersecurity firms in the Western world. I’ve read the texts, I’ve taken the classes.
I’m not saying I can just do bitwise AES over plaintext in my head. But I had no issue understanding the white papers Apple released that described the feature.
That didn’t convince me one iota that it was either a good nor necessary idea. It simply served to highlight the things Apple was being fairly arrogant about. And I say that as someone who daily-drives multiple Apple devices and am highly bought into the ecosystem.
They built a large part of their trust model with that effort upon the idea that two governments either wouldn’t or couldn’t collude to inject non-CSAM hashes into their database. It’s like they’ve never heard the term “Five Eyes” despite harboring serious credentials and contracts in _all_ the right spaces to know exactly how possible that would be.
It was a technologically clever idea, and if we lived in a “it’s this or that” world where we had to choose which technologies would be used to surveil our devices, it would be one of the best options developed to date.
However I don’t accept that premise because it’s not true.
Edit: typographical cleanup.
This is not correct. In the event that this happened, there would still be oversight at Apple before reporting to authorities.
But those hashes are produced and provided to Apple (edit: well, to any consumer of the hashes) by government backed actors. (Edited to replace “government agencies” with “government backed actors”.)
My misreading was that (paraphrased) “Apple could ensure the hashes they received were only for CSAM.”
That isn’t what you said. You noted that (paraphrasing) “internally Apple would have some validation functionality to ensure they were not reporting non-CSAM content.”
I was going to say I think your point is orthogonal, but I understand how it’s a response to what I wrote. I think we could rely on a reasonable set of people differentiating a perceptual hash of CSAM from non-CSAM content. That is no guarantee, but if their system worked as described then at some point they would be able to validate the actual stored images uploaded and know whether or not it was CSAM in an account.
Just leaving here that I would counter to others that make your original point constrained to CSAM flagged content only, that:
1. Given the fact that collisions were demonstrated in public before the system was fully implemented, this failure mode had the potential to create an unknown volume of false positives that Apple would have to deal with (which would unnecessarily expose user data to Apple contractors or employees).
2. We probably don’t want to enable corporations to have this kind of power (see recent stories regarding similar false positives at Google).
3. There was proposed no detailed plans for any sort of procedures about what happened next. What happens when Apple makes a report that was “close to the line” and later found not to be CSAM? The perceptual hash concept was not without vectors for human failures. What recourse would there have been if Apple closed an account due to a false positive?
I saw very little evidence of that. Practically everybody against the idea thought the device determined what was a match and uploaded evidence to Apple. Practically everybody against the idea thought “the” hash was broken. Practically everybody against the idea confused a hash false positive with the system’s false positive.
Yes, there were a few thoughtful criticisms and I would have liked to have seen more of them. But they were drowned out by abject nonsense.
> given how they paraded their backdoor approach as a way to eat their cake and have it too, it's unsurprising that it attracted the attention of governments.
It didn’t though? Has there been any government who wanted to take that system up? They all want something a lot more intrusive; the same kinds of things they have been asking for a long time before Apple’s proposal.
Doesn't the system output the result of the hash?
What is the difference?
As opposed to Google trying to have parents arrested for seeking medical care for their children during the pandemic lockdown?
> His wife called an advice nurse at their health care provider to schedule an emergency consultation for the next morning, by video because it was a Saturday and there was a pandemic going on. The nurse said to send photos so the doctor could review them in advance. With help from the photos, the doctor diagnosed the issue and prescribed antibiotics, which quickly cleared it up.
Because technology companies routinely capture so much data, they have been pressured to act as sentinels, examining what passes through their servers to detect and prevent criminal behavior. Child advocates say the companies’ cooperation is essential to combat the rampant online spread of sexual abuse imagery. But it can entail peering into private archives, such as digital photo albums — an intrusion users may not expect — that has cast innocent behavior in a sinister light in at least two cases The Times has unearthed.
“I knew that these companies were watching and that privacy is not what we would hope it to be,” Mark said. “But I haven’t done anything wrong.”
The police agreed. Google did not.
https://www.nytimes.com/2022/08/21/technology/google-surveil...
That's not just scanning things you upload to a public facing website, that's scanning everything on the device.
Bad start. I never mentioned Google.
> ... [the remainder of the message] ...
I do not understand how this is meant to weaken the case against what Apple did at all. If anything, it strengthens my resolve that tech companies should not be at liberty to even make these decisions.
No. They appeared to put in this effort, but at the end of the day they built a system which could be used for scanning any file on your device for any reason, saying "oh it's only for files uploaded to icloud" was obviously the first step. And then of course the fact that if anything was deemed innapropriate it would have been submitted to their own verification centre where someone would actually physically look at your pictures and then forward them to law enforcement, without you being notified that this has happened in any way - that doesn't sound like maximising privacy to me.
>>but I wouldn’t be opposed to the scheme Apple wanted to implement.
I would. It was a horrendous implementation and any on-device scanning should always be opposed to the maximum extent that you can bare.
They could already be doing this though, right? Unless some trustworthy external auditor has gone through the iOS/macOS/iPadOS source and audited that they don't (good luck with that.)
To be clear – you are saying this was an easy thing for Apple to construct?
> but at the end of the day they built a system which could be used for scanning any file on your device for any reason
This is factually untrue and also not in contrast to the amount of effort they put in.
> And then of course the fact that if anything was deemed innapropriate it would have been submitted to their own verification centre where someone would actually physically look at your pictures and then forward them to law enforcement
This is also factually incorrect. Did you read the technical documentation Apple published?
No.
>>This is factually untrue and also not in contrast to the amount of effort they put in.
How so? I fail to see how this system has anything that would prevent it from being used to scan any file on the device? Sure their design is only for pictures, but why would it be limited to them?
>>This is also factually incorrect.
It's not, that is exactly what their technical paper says.
>> Did you read the technical documentation Apple published?
I did, multiple times, I've been having these arguments for a long time now.
This kind of comment is exactly why they said lots of people didn’t understand the system.
Because it’s utterly untrue & appears to not display ANY understanding of the underlying system at all
It’s not true, it’s not how that works, it’s not how any of it works. It’s also something that could ONLY be true of they changed how everything worked.
I don't know why you keep implying I don't understand how the system works - I do.
And I literally don't see how you can take your position and believe in it.
The system as proposed would generate a special "similarity" hash for pictures that are about to be uploaded to icloud - then those hashes would be compared against an uninspectable database of hashes provided by apple in collaboration with law enforcement agencies.
Literally all that would need to change here is that this system would need to scan all files not just pictures(trivial) and either all the time or on request instead of on upload to icloud(trivial). And of course it's silly to believe nation states wouldn't force Apple to add their own hashes of anything they want into the database - after all there is no oversight process over this. This isn't a major change to how the whole system works, it's a minor change and one that definitely would be made with time "because think of the children/terrorists/etc"
You really don't see it as an absolultely inevitable consequence of this system being implemented and in fact just existing at all? If no, then you have more trust in Apple than I do.
I read the details. I think I understood it perfectly well. I found it very objectionable.
I think there’s a strong argument for and a strong argument against the system Apple designed. I wanted that discussion to be had instead of it all being washed away with knee-jerk ignorance.
> "No, it was opt-in not required by law."
Your comment indicates the answer is yes.
Trying to figure out where the gap may be...my guess is the view objections come from "people [who] didn’t read."
I found the other replies powerful evidence that other people did read, and had nuanced thoughts on this matter.
Not iCloud, since that would imply it was scanning entire device backups stored in iCloud.
It was intended to scan just the photos that you uploaded to their publicly accessible Photo sharing website, iCloud Photos, in a way that even Apple wouldn't have access to the results unless you uploaded more than 100 photos that matched known kiddie porn.
iCloud Photos is a photo sharing website accessible to the public, like Flickr. It has nothing to do with device backup.
Scanning device backups was not even on the table, unlike at Google, where they have been scanning device content for years now.
https://www.nytimes.com/2022/08/21/technology/google-surveil...
Backups entered the discussion because you claimed iCloud meant backups not photos. And your words suggest iCloud Backup is more private than it is. Scanning device backups was not part of the photo scanning plan. But it is on the table always without E2EE.
The article said backed up to Google Photos. And the photos were sent over Gmail and chat. It is not clear device backups were scanned or existed. And device content is a misleading name for backups in the context of scanning on devices.
That's not entirely correct, but close enough. Since that's a constant, we can ignore that. Outside of "make more money", different companies absolutely take different stances about things.
Most companies seem to have at least some amount of consistency in their stances, though.
Do no evil?
Your experience can of course be different
I don't think a closed-source E2EE implementation would do much to change that.
Not sure what you mean about closed source. If you’re implying that the FBI can break Apple’s encryption because it’s closed source, uh, sure.
If you use an ISP for email the ISP can be subpoenaed with you being aware. If you want run your own mail server from your house. A search warrant of your house for the mail server is required. Different notification standards.
Right, by building in what amounts to a back door.
> One of your photos must be an exact match for photos already existing in the CSAM database, at which point a report is generated
IIRC, one of your photos must match a hash that exists in the database, not an exact match to an image itself. That's the means by which end-to-end encryption is evaded. That evasion is why I call it a back door.
Really, my entire problem with the scheme was that it took place on the device itself rather than in the iCloud. While all smartphones are surveillance devices already, making one as overtly a surveillance device like this sets a precedent that I think is exceedingly harmful.
No, I didn't miss that point at all. It's just orthogonal to my objection to the scheme. I object to the idea of formally making highly personal devices like your phone into ones that are spying on you. We have more than enough of that sort of thing informally. To make it official could only make things worse for everybody, Apple users and otherwise.
Since the whole thing was about photos being stored in the cloud, it would have been much less objectionable to put the scanning on the cloud side of things. At least that's actually someone else's computer and not someone using your own hardware against you.
I don’t think they’re insincere if they oppose new regulations, yet begrudgingly comply with them if they become law despite their attempts to prevent that.
Few people/organizations are willing to die for their principles.