6 ms·

If it matches, am I guilty until found innocent? I have no illicit images, but false positives are always going to be a problem and even at sub-1% rates if you

If it matches, am I guilty until found innocent? I have no illicit images, but false positives are always going to be a problem and even at sub-1% rates if you're scanning literally every image stored on an iOS devices that could still be thousands of wrong matches. If I lose the false-positive lottery, am I going to have the police calling and have my mugshot in the evening news for "CP on their device" in particular in my state's months long backlog for digital forensics. Law enforcement aren't exactly known for their understanding of technical evidence like hash-matching. I'm very sympathetic/supportive of anti-CP initiatives in general, but this still seems problematic. PS - And before someone replies with "they aren't contacting the police," don't forget the "yet." Once this is in place they'll immediately get pressured by politicians and well-intentioned people alike to flag any positive detections to authorities who will overreact (as law enforcement has a history of doing, particularly around this topic).

shuckles 5y ago
In the United States, the process of reporting potential images of CSAM is defined by the government, and a technology company’s active responsibility ends with a report to the National Center for Missing and Exploited Children’s CyberTipline: https://www.missingkids.org/gethelpnow/cybertipline#whathappenstoinformationinacybertip https://www.missingkids.org/gethelpnow/cybertipline#whathapp...
- __blockcipher__ 5y ago
  From the article: > The automated system would proactively alert a team of human reviewers if it believes illegal imagery is detected, who would then contact law enforcement if the material can be verified. The scheme will initially roll out only in the US. This is dystopian and needs to be opposed, not applauded.
  - shuckles 5y ago
    This is how every single cloud service has worked for a decade. You’ll need to elaborate on how, exactly, you believe it’s dystopian. The article is clearly wrong, because Apple cannot know which jurisdiction to forward a report to. That is NCMEC’s responsibility.
    - cm2187 5y ago
      This is on your device, not hosted by a third party (and therefore not a third party liability). Kind of like if your microwave was checking that there wasn't any illegal activity happening in your home and phoning home if it has a suspicion. As others mentioned, privacy erosion only goes one way. This is a frontier being breached, i.e. searching your physical device without a warrant, and as usual in the name of CP (the alternative typical pretext being terrorism). It won't take very long before this gets extended to any illegal activity. Gay dating was an illegal activity until not so long ago. This sort of chinese-style monitoring is not desirable in any way, and I find it appalling that Apple seems to want to be the sponsor.
      - shuckles 5y ago
        No it’s not. Read the article: the proposed mechanism is implemented as part of photo upload to iCloud.
        cm2187 5y ago
        The title says "scan US phones", the article is behind a paywall.
        shuckles 5y ago
        https://archive.is/https://www.ft.com/content/14440f81-d405-452f-97e2-a81458f5411f https://archive.is/https://www.ft.com/content/14440f81-d405-...
        cm2187 5y ago
        Thanks. The article confirms the title, this is not about content uploaded to the cloud: Apple’s system is less invasive in that the screening is done on the phone, and “only if there is a match is notification sent back to those searching”, said Alan Woodward, a computer security professor at the University of Surrey. “This decentralised approach is about the best approach you could adopt if you do go down this route.”
  - marderfarker2 5y ago
    > will initially roll out only in the US. Ok so they’re planning to eventually roll out this spyware worldwide. I do not know how Americans can think China is bad in this while allowing this to happen.
    - trasz 5y ago
      Never ceases to amaze how people believe that China is somehow more oppressive than the the country with world highest incarceration rate.
      - skinkestek 5y ago
        You forget that death sentences are carried out much more swiftly in China. Also, while there's a lot to be said about court systems, public defenders etc in US I wouldn't compare the two.
      - elzbardico 5y ago
        China have actual slaves. You can't even know the real rate of incarceration in China, and trying to figure it out is almost a sure way to get arrested.
      - ggreer 5y ago
        The US has a high incarceration rate because it has a high crime rate. If EU countries had US levels of crime, they'd have US levels of incarceration. Also China doesn't count Uyghurs as incarcerated despite the fact that the PRC is committing genocide against them.[1] The PRC imprisons almost 2 million of Uyghurs a year. Of those, around a quarter million die. Oh and there's the forced sterilizations, destruction of mosques, brainwashing, banning of muslim-sounding names[2], forced labor, organ harvesting, and mandatory quartering of government agents.[3] 1. https://en.wikipedia.org/wiki/Uyghur_genocide https://en.wikipedia.org/wiki/Uyghur_genocide 2. https://en.wikipedia.org/wiki/Naming_laws_in_China https://en.wikipedia.org/wiki/Naming_laws_in_China 3. https://en.wikipedia.org/wiki/Civil_Servant-Family_Pair_Up https://en.wikipedia.org/wiki/Civil_Servant-Family_Pair_Up
        5y ago
- deleted 5y ago
  [deleted]
tyingq 5y ago
"I have no illicit images, but false positives are always going to be a problem" Or someone that doesn't like you can MMS/iMessage/e-mail you images that match PhotoDNA image hashes. Maybe even in a way where the images don't appear to be anything alarming.
- yellow_lead 5y ago
  Yep, Google can break SHA1, so what hash are they using? Proprietary information I assume.
  - heavyset_go 5y ago
    They aren't using file hashes like SHA1, but perceptual hashes and then a fuzzy metric like hamming distance to make a fuzzy match. It's entirely possible for two images that have nothing to do with each other to have similar hashes.
    - yellow_lead 5y ago
      Wow. That's much worse.
    - tyingq 5y ago
      Yes, that's what I was alluding to. It's a perceptual hash, so you could probably take a flagged image and superficially alter it (contrast/color/crop/whatever) until it wasn't anything visually objectionable on it's own. But it would still match the perceptual hash.
      - cududa 5y ago
        The poor souls that do the work of entering the images into the database select identification blocks, not showing the victim (a lamp, wall paper, etc), that reviewers on the “client” side check against

shuckles 5y ago

In the United States, the process of reporting potential images of CSAM is defined by the government, and a technology company’s active responsibility ends with a report to the National Center for Missing and Exploited Children’s CyberTipline: https://www.missingkids.org/gethelpnow/cybertipline#whathappenstoinformationinacybertip https://www.missingkids.org/gethelpnow/cybertipline#whathapp...

__blockcipher__ 5y ago
From the article: > The automated system would proactively alert a team of human reviewers if it believes illegal imagery is detected, who would then contact law enforcement if the material can be verified. The scheme will initially roll out only in the US. This is dystopian and needs to be opposed, not applauded.
- shuckles 5y ago
  This is how every single cloud service has worked for a decade. You’ll need to elaborate on how, exactly, you believe it’s dystopian. The article is clearly wrong, because Apple cannot know which jurisdiction to forward a report to. That is NCMEC’s responsibility.
  - cm2187 5y ago
    This is on your device, not hosted by a third party (and therefore not a third party liability). Kind of like if your microwave was checking that there wasn't any illegal activity happening in your home and phoning home if it has a suspicion. As others mentioned, privacy erosion only goes one way. This is a frontier being breached, i.e. searching your physical device without a warrant, and as usual in the name of CP (the alternative typical pretext being terrorism). It won't take very long before this gets extended to any illegal activity. Gay dating was an illegal activity until not so long ago. This sort of chinese-style monitoring is not desirable in any way, and I find it appalling that Apple seems to want to be the sponsor.
    - shuckles 5y ago
      No it’s not. Read the article: the proposed mechanism is implemented as part of photo upload to iCloud.
      - cm2187 5y ago
        The title says "scan US phones", the article is behind a paywall.
        shuckles 5y ago
        https://archive.is/https://www.ft.com/content/14440f81-d405-452f-97e2-a81458f5411f https://archive.is/https://www.ft.com/content/14440f81-d405-...
        cm2187 5y ago
        Thanks. The article confirms the title, this is not about content uploaded to the cloud: Apple’s system is less invasive in that the screening is done on the phone, and “only if there is a match is notification sent back to those searching”, said Alan Woodward, a computer security professor at the University of Surrey. “This decentralised approach is about the best approach you could adopt if you do go down this route.”
- marderfarker2 5y ago
  > will initially roll out only in the US. Ok so they’re planning to eventually roll out this spyware worldwide. I do not know how Americans can think China is bad in this while allowing this to happen.
  - trasz 5y ago
    Never ceases to amaze how people believe that China is somehow more oppressive than the the country with world highest incarceration rate.
    - skinkestek 5y ago
      You forget that death sentences are carried out much more swiftly in China. Also, while there's a lot to be said about court systems, public defenders etc in US I wouldn't compare the two.
    - elzbardico 5y ago
      China have actual slaves. You can't even know the real rate of incarceration in China, and trying to figure it out is almost a sure way to get arrested.
    - ggreer 5y ago
      The US has a high incarceration rate because it has a high crime rate. If EU countries had US levels of crime, they'd have US levels of incarceration. Also China doesn't count Uyghurs as incarcerated despite the fact that the PRC is committing genocide against them.[1] The PRC imprisons almost 2 million of Uyghurs a year. Of those, around a quarter million die. Oh and there's the forced sterilizations, destruction of mosques, brainwashing, banning of muslim-sounding names[2], forced labor, organ harvesting, and mandatory quartering of government agents.[3] 1. https://en.wikipedia.org/wiki/Uyghur_genocide https://en.wikipedia.org/wiki/Uyghur_genocide 2. https://en.wikipedia.org/wiki/Naming_laws_in_China https://en.wikipedia.org/wiki/Naming_laws_in_China 3. https://en.wikipedia.org/wiki/Civil_Servant-Family_Pair_Up https://en.wikipedia.org/wiki/Civil_Servant-Family_Pair_Up
      - 5y ago
deleted 5y ago
[deleted]

tyingq 5y ago

"I have no illicit images, but false positives are always going to be a problem" Or someone that doesn't like you can MMS/iMessage/e-mail you images that match PhotoDNA image hashes. Maybe even in a way where the images don't appear to be anything alarming.

yellow_lead 5y ago
Yep, Google can break SHA1, so what hash are they using? Proprietary information I assume.
- heavyset_go 5y ago
  They aren't using file hashes like SHA1, but perceptual hashes and then a fuzzy metric like hamming distance to make a fuzzy match. It's entirely possible for two images that have nothing to do with each other to have similar hashes.
  - yellow_lead 5y ago
    Wow. That's much worse.
  - tyingq 5y ago
    Yes, that's what I was alluding to. It's a perceptual hash, so you could probably take a flagged image and superficially alter it (contrast/color/crop/whatever) until it wasn't anything visually objectionable on it's own. But it would still match the perceptual hash.
    - cududa 5y ago
      The poor souls that do the work of entering the images into the database select identification blocks, not showing the victim (a lamp, wall paper, etc), that reviewers on the “client” side check against