5 ms·

This system is likely closely related to full encrypted E2E iCloud backups: https://www.reuters.com/article/us-apple-fbi-icloud-exclusive/exclusive-apple-droppe

This system is likely closely related to full encrypted E2E iCloud backups: https://www.reuters.com/article/us-apple-fbi-icloud-exclusive/exclusive-apple-dropped-plan-for-encrypting-backups-after-fbi-complained-sources-idUSKBN1ZK1CT https://www.reuters.com/article/us-apple-fbi-icloud-exclusiv...

twobitshifter 5y ago
Were iCloud photos already scanned CSAM? In the on-device system, if you're not using iCloud are the photos scanned? If that's true, as an iCloud user you are exactly as likely to be charged with a crime based on your photos as you were before, but you now get E2E encryption. Obviously I'd prefer E2E without any scanning. If I wanted to upload a pirated mp3 to icloud, I wouldn't want the RIAA knocking on my door. However, given that scanning was already in place, is this a step forward?
- testvox 5y ago
  > If that's true, as an iCloud user you are exactly as likely to be charged with a crime based on your photos as you were before Is this strictly true? I feel like the evidence that a photo was present on specific device is different from evidence that a photo was uploaded by a specific account (and a specific ip address probably). It seems like it would be far easier for the government to justify a search warrant if they have evidence the photo they are looking for was on a specific device. Just having evidence that a specific account uploaded a photo seems like far shakier grounds to search a specific device, after all accounts are often stolen to be used for criminal purposes and ip addresses don't map cleanly to people or devices.
  - twobitshifter 5y ago
    Maybe there’s some plausible deniability if a warrant uncovered nothing - but I think they would always be able get a warrant and try to find the device and more evidence based on the upload. From what I’ve read the on-phone scanning only alerts after multiple photos and is designed to have a 1 in a trillion false positive rate. If the iCloud scan is similar they would have a strong case for getting a warrant based on uploads.
- least 5y ago
  The entire reason to encrypt data before transferring is to preserve privacy of the individual, which is completely irrelevant when you have a system in place to scan everything before it ever gets uploaded. It's like living in the glass apartments of Yevgeny Zamyatin's We but still thinking we're preserving privacy because we put our items into an opaque box.
thesimon 5y ago
But why would Apple not mention this, if that was their intention?

twobitshifter 5y ago

Were iCloud photos already scanned CSAM? In the on-device system, if you're not using iCloud are the photos scanned? If that's true, as an iCloud user you are exactly as likely to be charged with a crime based on your photos as you were before, but you now get E2E encryption. Obviously I'd prefer E2E without any scanning. If I wanted to upload a pirated mp3 to icloud, I wouldn't want the RIAA knocking on my door. However, given that scanning was already in place, is this a step forward?

testvox 5y ago
> If that's true, as an iCloud user you are exactly as likely to be charged with a crime based on your photos as you were before Is this strictly true? I feel like the evidence that a photo was present on specific device is different from evidence that a photo was uploaded by a specific account (and a specific ip address probably). It seems like it would be far easier for the government to justify a search warrant if they have evidence the photo they are looking for was on a specific device. Just having evidence that a specific account uploaded a photo seems like far shakier grounds to search a specific device, after all accounts are often stolen to be used for criminal purposes and ip addresses don't map cleanly to people or devices.
- twobitshifter 5y ago
  Maybe there’s some plausible deniability if a warrant uncovered nothing - but I think they would always be able get a warrant and try to find the device and more evidence based on the upload. From what I’ve read the on-phone scanning only alerts after multiple photos and is designed to have a 1 in a trillion false positive rate. If the iCloud scan is similar they would have a strong case for getting a warrant based on uploads.
least 5y ago
The entire reason to encrypt data before transferring is to preserve privacy of the individual, which is completely irrelevant when you have a system in place to scan everything before it ever gets uploaded. It's like living in the glass apartments of Yevgeny Zamyatin's We but still thinking we're preserving privacy because we put our items into an opaque box.

thesimon 5y ago

But why would Apple not mention this, if that was their intention?