4 ms·

I think it's easy to say no to any solution, but harder to say "this is bad, but we should do this instead to solve the problem". In a world with ubiquitous/dis

I think it's easy to say no to any solution, but harder to say "this is bad, but we should do this instead to solve the problem". In a world with ubiquitous/distributed communication, the ideas that come up would generally avoid direct interception but need some way to identify a malicious transaction. When saying no to ideas like this, we should at the same time attempt to also share our thoughts on what would be an acceptable alternative solution.

cwizou 5y ago
I think everyone is offended on scanning being done on device and not on their servers (which I had assumed they might already did, quite frankly, Google Photos and others already do), and selling that as being privacy forward. Considering they hold the keys and the scheme already allows them to decrypt as a last step the users photos, this is not exactly a progress. It just maintains the illusion that those backups are encrypted while they (ultimately) aren't. I've personally (and some may disagree) always assumed that anything you put in any cloud (and that includes the very convenient iCloud backups that I use) is fair game for local authorities, whether that's true in practice or not. Putting a "snitch" on device, even if it's only for content that's going to the cloud (and in the case of an iCloud backup, doesn't that mean all your iPhone content ?) is the part that goes a step too far and will lead to laws in other countries asking for even more. Once you've opened the door to on device scanning, why limit it to data that goes to iCloud ? Why limit it to photos ? They proved they have the "tech" and governments around the world will ask for it to be bent to their needs. I'm sure the intent was well meaning but I'd much rather they just do this on their premises and not try to pretend they do this for privacy.
- imranhou 5y ago
  Imagine someone was hired to reduce the problem of child trafficking/exploitation, and are the head of this group at the justice dept. Lets say they have the option to work with private orgs that may have solutions that could walk a fine line between privacy and their dept goals. I'm interested in knowing your perspective on how one should approach achieving these goals.
  - cwizou 5y ago
    Quite frankly I'm not sure this should be the role of one employee of a justice department, so I'm not sure how to answer this ? At the end of the day I think that any such effort should be legislated, in any jurisdiction, and not just rely on the good will that a government (or one of its employee) can garner from private orgs. As to what legislation should look like, this is a complex issue, many countries are making various form of interceptions legal (mostly around terrorism) already. Should a law clearly mandating that any cloud provider scan their users content through some technology like Microsoft's PhotoDNA be passed by various local governments ? I'd much rather see that, personally. Again, my opposition to this is centered around the fact that Apple is doing this on device and selling this as, as you put it, walking a fine line with their privacy stance. While it may have been their original intent, I believe they have opened a door for legislators around the world to ask this technology be extended for other purposes, and given time, they absolutely will. You didn't ask but what I wish Apple did was what everyone else did : scan on their servers, because they can, and not do it on device to keep the illusion that they can't access your photos. Edit : Random link about PhotoDNA being used by Google and Facebook, there are probably better sources : https://petapixel.com/2014/08/08/photodna-lets-google-facebook-others-hunt-down-child-pornography-without-looking-at-your-photos/ https://petapixel.com/2014/08/08/photodna-lets-google-facebo...
    - cwizou 5y ago
      Can't edit any more but as provided in another thread by another user, they were already, as I had originally assumed, doing it server side : https://nakedsecurity.sophos.com/2020/01/09/apples-scanning-icloud-photos-for-child-abuse-images/ https://nakedsecurity.sophos.com/2020/01/09/apples-scanning-...
suizi 5y ago
It's not that I don't want to give you a sunny solution which makes the problem go away forever, but this is an extremely difficult problem to solve, especially as someone might be located in some foreign country with ineffective law enforcement. Facebook has been making it harder for random strangers to contact people under a certain age, so that may well help, and we'll see if it does. And we could probably teach teenagers how to remain safe on the internet, and give the support needed to not be too emotionally reliant on the internet. That might get you part of the way. You could run TV advertisements to raise awareness about how abuse is harmful to try to dissuade people from doing it, but that might make the general public more scared of it (the chances their family specifically will be affected has to be remote), and more inclined to "regulate" their way out of the problem. You could try to take more children away from their families on the off-chance they may have been abused, but what if you make the wrong call? That could be traumatizing to them. You could go down the road of artificial child porn to compete with child porn, and robots which look like children, but I don't think the predators specifically are interested in those, are they? And that comes with some serious ethical issues, and is politically impossible. We can't just profile "whoever looks suspicious" on the street, because people who are mentally ill tend to behave erratically, only have a slightly high chance of being guilty, but have a dramatically high chance of being harassed by police. If we can get out of the covid pandemic, this may help. Child abuse is said to have risen by a factor of 4 during the lockdowns, and all those other things which were put in place to contain the virus. It's possible that stress from the pandemic, and perhaps, opportunities to commit a crime may have contributed to this. But, this is an international problem, even if the pandemic were to vanish in the U.S., it may still exist overseas.

cwizou 5y ago

I think everyone is offended on scanning being done on device and not on their servers (which I had assumed they might already did, quite frankly, Google Photos and others already do), and selling that as being privacy forward. Considering they hold the keys and the scheme already allows them to decrypt as a last step the users photos, this is not exactly a progress. It just maintains the illusion that those backups are encrypted while they (ultimately) aren't. I've personally (and some may disagree) always assumed that anything you put in any cloud (and that includes the very convenient iCloud backups that I use) is fair game for local authorities, whether that's true in practice or not. Putting a "snitch" on device, even if it's only for content that's going to the cloud (and in the case of an iCloud backup, doesn't that mean all your iPhone content ?) is the part that goes a step too far and will lead to laws in other countries asking for even more. Once you've opened the door to on device scanning, why limit it to data that goes to iCloud ? Why limit it to photos ? They proved they have the "tech" and governments around the world will ask for it to be bent to their needs. I'm sure the intent was well meaning but I'd much rather they just do this on their premises and not try to pretend they do this for privacy.

imranhou 5y ago
Imagine someone was hired to reduce the problem of child trafficking/exploitation, and are the head of this group at the justice dept. Lets say they have the option to work with private orgs that may have solutions that could walk a fine line between privacy and their dept goals. I'm interested in knowing your perspective on how one should approach achieving these goals.
- cwizou 5y ago
  Quite frankly I'm not sure this should be the role of one employee of a justice department, so I'm not sure how to answer this ? At the end of the day I think that any such effort should be legislated, in any jurisdiction, and not just rely on the good will that a government (or one of its employee) can garner from private orgs. As to what legislation should look like, this is a complex issue, many countries are making various form of interceptions legal (mostly around terrorism) already. Should a law clearly mandating that any cloud provider scan their users content through some technology like Microsoft's PhotoDNA be passed by various local governments ? I'd much rather see that, personally. Again, my opposition to this is centered around the fact that Apple is doing this on device and selling this as, as you put it, walking a fine line with their privacy stance. While it may have been their original intent, I believe they have opened a door for legislators around the world to ask this technology be extended for other purposes, and given time, they absolutely will. You didn't ask but what I wish Apple did was what everyone else did : scan on their servers, because they can, and not do it on device to keep the illusion that they can't access your photos. Edit : Random link about PhotoDNA being used by Google and Facebook, there are probably better sources : https://petapixel.com/2014/08/08/photodna-lets-google-facebook-others-hunt-down-child-pornography-without-looking-at-your-photos/ https://petapixel.com/2014/08/08/photodna-lets-google-facebo...
  - cwizou 5y ago
    Can't edit any more but as provided in another thread by another user, they were already, as I had originally assumed, doing it server side : https://nakedsecurity.sophos.com/2020/01/09/apples-scanning-icloud-photos-for-child-abuse-images/ https://nakedsecurity.sophos.com/2020/01/09/apples-scanning-...

suizi 5y ago

It's not that I don't want to give you a sunny solution which makes the problem go away forever, but this is an extremely difficult problem to solve, especially as someone might be located in some foreign country with ineffective law enforcement. Facebook has been making it harder for random strangers to contact people under a certain age, so that may well help, and we'll see if it does. And we could probably teach teenagers how to remain safe on the internet, and give the support needed to not be too emotionally reliant on the internet. That might get you part of the way. You could run TV advertisements to raise awareness about how abuse is harmful to try to dissuade people from doing it, but that might make the general public more scared of it (the chances their family specifically will be affected has to be remote), and more inclined to "regulate" their way out of the problem. You could try to take more children away from their families on the off-chance they may have been abused, but what if you make the wrong call? That could be traumatizing to them. You could go down the road of artificial child porn to compete with child porn, and robots which look like children, but I don't think the predators specifically are interested in those, are they? And that comes with some serious ethical issues, and is politically impossible. We can't just profile "whoever looks suspicious" on the street, because people who are mentally ill tend to behave erratically, only have a slightly high chance of being guilty, but have a dramatically high chance of being harassed by police. If we can get out of the covid pandemic, this may help. Child abuse is said to have risen by a factor of 4 during the lockdowns, and all those other things which were put in place to contain the virus. It's possible that stress from the pandemic, and perhaps, opportunities to commit a crime may have contributed to this. But, this is an international problem, even if the pandemic were to vanish in the U.S., it may still exist overseas.