7 ms·
The NCMEC database that Apple is likely using to match hashes, contains countless non-CSAM pictures that are entirely legal not only in the U.S. but globally.
by 0xy 5y ago
The NCMEC database that Apple is likely using to match hashes, contains countless non-CSAM pictures that are entirely legal not only in the U.S. but globally.
This should be reason enough for you to not support the idea.
From day 1, it's matching legal images and phoning home about them. Increasing the scope of scanning is barely a slippery slope, they're already beyond the stated scope of the database.
- wbl 5y agoCould you say more about these legal photos? That's a pretty big difference from what I thought was contained in the DB.
- 0xy 5y agoIf there are pictures recovered alongside CSAM but are not CSAM themselves they can be included in the database. The thing I can publicly say is that the database is not strictly for illegal or even borderline imagery. NCMEC try to keep the contents, processes and access to the database under wraps for obvious reasons.
- oh_sigh 5y agoSo are we talking about images which are not actually CSAM but a reasonable person would consider to be CSAM if they encountered them? Or is it just the README.txt for whatever popular bittorrent client?
- 0xy 5y agoA reasonable person would call it a normal picture if they encountered it in isolation. Like I said, content which is not even borderline are included. By both a legal and moralistic standard they're not CSAM. Not even nearly. Of course, this is a minority of the content in the database. But even 1 such image is gross neglect of stated purpose in my book.
- azinman2 5y agoBut are these photos that are combined in a row with other CP, and thus indicative that if you have this photo, it’s from a CP collection? Why would I have any content in my phone that would be in that database?
- pseudalopex 5y agoIt's easy to imagine a collection with pictures from numerous sources. Including pictures of adults.
- 0xy 5y agoImagine things like: - A kitchen with nobody in frame. - A couch with nobody in frame. - Outdoor scenery with nobody in frame. - A bathroom with nobody in frame. Is it hard to believe you wouldn't download something like this without knowing where it came from? I'm not talking about borderline stuff. I'm talking about content that has not even a hint of pornography or illegality.
- oauea 5y agoSo why is it in there and why do they care?
- aethertron 5y agoMaybe cropped photos, or innocent frames from videos containing abuse? Not sure what GP is referring to.
- salawat 5y agoI am reminded of an infamous couch and pool that are notorious for appearing in many adult productions... Possibly stock footage of a production room or repeating prop intended for being subsampled for so that multiple or repeated works by the same person or group can be flagged. I recall a person of interest was arrested after of all things posting a completely benign YouTube tutorial video. My thought at the time was likely a prop match to the environment or some such within the video. The method is definitely doable. Partitioned out to every consumer device with unflinching acceptance? Yeahhhh. Remember, these databases are essentially signature DB's, and there is no guarantee that all hashes are just doing a naive match on the entire file, or that all scans performedare fundamentally the same. This is why I reject outright the legitimacy of any Client-based CSAM scanners. In a closed source environment, it's yet another blob, therefore an arbitrary code execution vector. I'm sorry, but in my calculus, I'm not willing to buy into that, even for CSAM. It won't stay just filesystems. It won't stay just hash matching. The fact there's so much secrecy around ways and means implies there's likely dynamicity in what they are looking for, and with the permissions and sensors on a phone that many apps already ask for, my not one inch instincts are sadly firmly engaged with no signs of letting up. I'm totally behind the fight. I'm not an idiot though, and I know what the road to hell is paved with. Law Enforcement and anti-CSAM agencies are cut a lot of slack, and enjoy a lot of unquestioning acceptance by the populace. In my book, this warrants more scrutiny, and caution not less. The rash of inconvenient people being rather frequently called out as having CSAM found on hard drives in media with no additional context indicates the CSAM definition is being wielded in a manner that produces a great degree of political convenience. Again, more scrutiny, not less.
- stevekemp 5y agoI would imagine it would include things like Nirvana's Nevermind album-cover, or a better example Scorpion's album cover for Virgin Killer.
- katbyte 5y agoTil - and both findable via a google imagine search
- deleted 5y ago[deleted]
- meowface 5y agoCan you give more information about this? What kind of legal images might it match?
- aphroz 5y agoWhat about pictures of you own children naked ?
- 0xy 5y agoThis isn't CSAM or illegal, nor would it ever end up in a database. Speaking generally, content has to be sexualized or have a sexual purpose to be illegal. Simple nudity does not count inherently.
- jsjohnst 5y ago> Simple nudity does not count inherently. That’s not entirely true. If a police officer finds you in possession of a quantity of CP, especially of multiple different children, you’ll at least be brought in for questioning if not arrested/tried/convicted, whether the images were sexualized or not. > nor would it ever end up in a database That’s a bold blanket statement coming from someone who correctly argued that NCMEC’s database has issues (as in I know your previous claim is true because I’ve seen false positives for completely innocent images, both legally and morally). That said, with the amount of photos accidentally shared online (or hacked), to say that GP’s scenario can not ever end up in a database seems a bit off the mark. It’s very unlikely as sibling commenter said, but still possible.
- 0xy 5y ago>That’s not entirely true That's why I said it's not inherently illegal. Of course, if you have a folder called "porn" that is full of naked children it modifies the context and therefore the classification. But, if it's in a folder called "Beach Holiday 2019", it's not illegal nor really morally a problem. I'm dramatically over-simplifying of course. "It depends" all the way down. >That’s a bold blanket statement You're right, I shouldn't have been so broad. It's possible but unlikely, especially if it's not shared on social media. It reinforces my original point however, because I can easily see a case where there's a totally voluntary nudist family who posts to social media getting caught up in a damaging investigation because of this. If their pictures end up in the possession of unsavory people and gets lumped into NCMEC's database then it's entirely possible they get flagged dozens or hundreds of times and get referred to police. Edge case, but a family is still destroyed over it. Some wrongfully accused people have their names tarnished permanently. This kind of policy will lead to innocent people getting dragged through the mud. For that reason alone, this is a bad idea.
- voldacar 5y agoWhy would there be legal images in the db? do you have a source for that?
- slg 5y agoTo be fair the Twitter thread says (emphasis mine) "These tools will allow Apple to scan your iPhone photos for photos that match a specific perceptual hash, and report them to Apple servers if too many appear." I don't know what the cutoff is, but it doesn't sound like they believe that possession of a single photo in the database is inherently illegal. That doesn't mean this is overall a good idea. It simply weakens your specific argument about occasional false positives.
- GoOnThenDoTell 5y agoI hardly trust a cutoff number to be the arbiter of privacy or justice
- onetimeusename 5y agoThe database seems legally murky. First of all, who would want to actually manually verify that there aren't any images in it that shouldn't be? If the public can even request to see it, which I doubt, would you be added to a watch list of potentially dangerous people or destroy your own reputation? Who adds images to it and where do they get those images from? My point is that we have no way to verify the database wouldn't be abused or mistaken and a lot of that rests on the fact that CSAM is not something people want to have to encounter, ever.
- oauea 5y agoNot an American, but shouldn't you be able to FOIA this?
- jaywalk 5y agoThe NCMEC, who manages the CSAM database, is a private organization.
- oauea 5y agoWait, so two American companies, Apple and NCMEC, are working together to install spyware on all Apple devices world-wide, with no government involvement?
- fl0wenol 5y agoNot quite, they're an NGO and the CyberTipline which it operates (the database Apple will use) was established by S.1738 [PROTECT our Children Act of 2008], and they get an appropriation from Congress to run that and work with law enforcement. It's kind of like the PCAOB... private 501.3(c) with congressional oversight and funding. I think the strategy is that the organization is able to do more for helping children internationally if they're not seen as part of the Justice department and the executive, which after the debacle with CBP and "kids in cages", was probably the right call.
- deleted 5y ago[deleted]
- suizi 5y agoNCMEC is an private organization created by the U.S. Government, funded by the U.S. Government, operates with no constitutional scrutiny, operates with no oversight / accountability, could be prodded by the U.S. Government, and they tell you to "trust them".