5 ms·

Could you point to the regulation that requires this?

macintux 5y ago
See the “Federal CSAM Law” section here: https://cyberlaw.stanford.edu/blog/2020/01/earn-it-act-how-ban-end-end-encryption-without-actually-banning-it https://cyberlaw.stanford.edu/blog/2020/01/earn-it-act-how-b... > Section 2258A of the law imposes duties on online service providers, such as Facebook and Tumblr and Dropbox and Gmail. The law mandates that providers must report CSAM when they discover it on their services, and then preserve what they’ve reported (because it’s evidence of a crime).
- dannyw 5y ago
  The law doesn't require them to actively go around scanning for it.
  - jachee 5y ago
    They’re scanning for it as it enters their system. It’s only scanned if it’s set to go to iCloud.
    - noduerme 5y ago
      Yes, but then there's a way to upload it in plaintext. That's the backdoor. That can, and will, eventually be used to exfiltrate any file, anytime, whether it would be going to the cloud or not.
      - macintux 5y ago
        It does set a terrible precedent, but it's possible this is a step towards E2E encryption on iCloud data; a way to comply with the law while preventing law enforcement from being able to subpoena other data. Apple is being its usual cryptic self about this, which is once again breeding uncertainty, but I still have hope in the end this will work out.
        noduerme 5y ago
        Again though, what is the guarantee this is only going to be used to scan data uploaded to the cloud? If Apple has the ability to exfiltrate data from a phone at whim, they lose any deniability or leverage they still have with authoritarian regimes that want all the data on a phone. It's not just a terrible precedent, it's a dangerous piece of malware.
        dwaite 5y ago
        They of course have the ability to exfiltrate data, they created the hardware and OS. However since this is part of the opt-in iCloud photos sharing mechanism, it doesn’t appear they have started to exfiltrate data without consent.
        noduerme 5y ago
        >> They of course have the ability to exfiltrate data, they created the hardware and OS. I don't in know why you're assuming they have a backdoor built in already. The whole point is that they don't, but they're going to add one.
        dwaite 5y ago
        I don’t count this as data exfiltration because it only releases data if you are doing iCloud photos sync, which is opt in. iCloud photo sync has also always been recoverable on the server by government request. So they have always been one software update from non-opt-in data exfiltration and remain so.

See the “Federal CSAM Law” section here: https://cyberlaw.stanford.edu/blog/2020/01/earn-it-act-how-ban-end-end-encryption-without-actually-banning-it https://cyberlaw.stanford.edu/blog/2020/01/earn-it-act-how-b... > Section 2258A of the law imposes duties on online service providers, such as Facebook and Tumblr and Dropbox and Gmail. The law mandates that providers must report CSAM when they discover it on their services, and then preserve what they’ve reported (because it’s evidence of a crime).

dannyw 5y ago
The law doesn't require them to actively go around scanning for it.
- jachee 5y ago
  They’re scanning for it as it enters their system. It’s only scanned if it’s set to go to iCloud.
  - noduerme 5y ago
    Yes, but then there's a way to upload it in plaintext. That's the backdoor. That can, and will, eventually be used to exfiltrate any file, anytime, whether it would be going to the cloud or not.
    - macintux 5y ago
      It does set a terrible precedent, but it's possible this is a step towards E2E encryption on iCloud data; a way to comply with the law while preventing law enforcement from being able to subpoena other data. Apple is being its usual cryptic self about this, which is once again breeding uncertainty, but I still have hope in the end this will work out.
      - noduerme 5y ago
        Again though, what is the guarantee this is only going to be used to scan data uploaded to the cloud? If Apple has the ability to exfiltrate data from a phone at whim, they lose any deniability or leverage they still have with authoritarian regimes that want all the data on a phone. It's not just a terrible precedent, it's a dangerous piece of malware.
        dwaite 5y ago
        They of course have the ability to exfiltrate data, they created the hardware and OS. However since this is part of the opt-in iCloud photos sharing mechanism, it doesn’t appear they have started to exfiltrate data without consent.
        noduerme 5y ago
        >> They of course have the ability to exfiltrate data, they created the hardware and OS. I don't in know why you're assuming they have a backdoor built in already. The whole point is that they don't, but they're going to add one.
        dwaite 5y ago
        I don’t count this as data exfiltration because it only releases data if you are doing iCloud photos sync, which is opt in. iCloud photo sync has also always been recoverable on the server by government request. So they have always been one software update from non-opt-in data exfiltration and remain so.