19 ms·

NCMEC has essentially shows that they have zero regard for privacy and called all privacy activists "screeching voices of the minority". At the same time, they'

NCMEC has essentially shows that they have zero regard for privacy and called all privacy activists "screeching voices of the minority". At the same time, they're at the center point of a highly opaque, entrenched (often legally mandated) censorhip infrastructure that can and will get accounts shut down irrecoverably and possibly people's homes raided, on questionable data: In one of the previous discussions, I've seen claims about the NCMEC database containing a lot of harmless pictures misclassified as CSAM. This post confirms this again (ctrl-f "macaque") It also seems like the PhotoDNA hash algorithm is problematic (to the point where it may be possible to trigger false matches). Now NCMEC seem to be pushing for the development of a technology that would implant an informant in every single of our devices (mandating the inclusion of this technology is the logical next step that seems inevitable if Apple launches this). I'm surprised, and honestly disappointed, that the author seems to still play nice, instead of releasing the whitepaper. The NCMEC seems to have decided to position itself directly alongside other Enemies of the Internet, and while I can imagine that they're also doing a lot of important and good work, at this point, I don't think they're salvageable would like to see them disbanded. Really curious how this will play out. I expect attacks either sabotaging these scanning systems by flooding them with false positives, or exploiting them to get the accounts of your enemies shut down permanently by sending them a picture of a macaque.

lilSebastian 5y ago
> It also seems like the PhotoDNA hash algorithm is problematic (to the point where it may be possible to trigger false matches A post here some days ago (since removed) linked to a google drive containing generated images (which displayed nonsense), the hashes of which matched those of genuine problems images.
gerash 5y ago
I agree. NCMEC is the root cause. It's very much like the war on drugs. There are a lot of horrendous crimes out there and this level of overreach isn't deemed necessary for any of them. Child sex abuse seems to have become the excuse to create these heavy handed policies to terminate accounts with no recourse by Google and scanning locally stored photos by Apple. Even receiving a cartoon depicting child sex abuse can get you in trouble. Hopefully this will be a catalyst to reform the law.
judge2020 5y ago
> I'm surprised, and honestly disappointed, that the author seems to still play nice Stopping to that level is what they want, CNN: “‘privacy activists’ have released a tool to allow the spread of CP”
- zionic 5y ago
  If that’s how they play then the only winning move is to respond in kind. >shadowy government affiliated agency abuses its role of protecting children to install malware on a billion devices
  - Sebb767 5y ago
    That's not even news at this point. Privacy invading laws have been pushed for years under the guise of either CP or terrorism.
  - andrewflnr 5y ago
    That's a PR fight you will lose.
    - throwaway09223 5y ago
      I'm not so sure, I think it may be a lose-lose scenario, with both the government and the companies who's products have become compromised taking a big hit. The people merely avoiding the tainted products aren't on blast here.
      - andrewflnr 5y ago
        The people on blast are the ones publicly advocating for privacy. They're the ones who would be damaged in that scenario, and I for one want a society that takes them seriously.
        throwaway09223 5y ago
        Well, it doesn't look that way so far. I haven't seen any credible mainstream positions ridiculing the people advocating for privacy. It seems like everyone's pretty well aware that technology sucks and systems like this are not to be trusted, even if they're implemented with good intentions. We will see.
deleted 5y ago
[deleted]
Thorrez 5y ago
>I'm surprised, and honestly disappointed, that the author seems to still play nice, instead of releasing the whitepaper. Would it help anything? Apple isn't using PhotoDNA, so proving PhotoDNA is bad would just be met with "we don't use that".
- heavyset_go 5y ago
  I believe it would because other image systems will probably have to make similar implementations and trade offs that PhotoDNA did.
  - tablespoon 5y ago
    >> Would it help anything? Apple isn't using PhotoDNA, so proving PhotoDNA is bad would just be met with "we don't use that". > I believe it would because other image systems will probably have to make similar implementations and trade offs that PhotoDNA did. Even if that's the case, that's too subtle of a point to be very effective, and you'll have all kinds of PR people (Apple and otherwise) selling the "we don't use that [so those criticisms don't apply to us]" narrative.
  - zepto 5y ago
    Why? It would be interesting to compare the two systems, but there is no reason to assume the trade-offs are the same.
    - heavyset_go 5y ago
      There are trade offs that can be made that are inherent to the space. There are a handful of hashing methods in papers, and each can have its parameters tuned, again making trade offs for things like efficiency or accuracy. Then when it comes to efficient searching through hashes for matches and fuzzy matches, there are common algorithms and data structures used across perceptual hashing systems, each with with their own trade offs, implementation details and parameters that can be tuned. If there's an issue with PhotoDNA that doesn't come down to a poor implementation, then there's a good chance that other systems might have met the same pitfalls they did. And if it comes down to a poor implementation, it would be prudent for operators of other systems to make sure their own systems don't make the same mistakes.
zionic 5y ago
It’s not enough to disband the NCMEC, I want jail time for these people. This is literally conspiracy to undermine the privacy and security of over a billion devices (and their users) to catch a “small minority” of criminals. These people deserve to lose their homes and freedom for this, along with every engineer and executive that participated.
- nyx-aiur 5y ago
  wtf. are you OK? Your whole comment history looks like a guy diving in a really bad conspiracy rabbit hole.
hackerfactor1 5y ago
> I'm surprised, and honestly disappointed, that the author seems to still play nice, instead of releasing the whitepaper. I'm the author. I've worked with different parts of NCMEC for years. (I built the initial FotoForensics service in a few days. Before I wrote the first line of code, I was in phone calls with NCMEC about my reporting requirements.) Over time, this relationship grew. Some years, I was in face-to-face development discussions, other times it have been remote communications. To me, there are different independent parts working inside NCMEC. The CyberTipline and their internal case staff are absolutely incredible. They see the worst of people in the media and reports that they process. They deal with victims and families. And they remain the kindest and most sincere people I've ever encountered. When possible, I will do anything needed to make their job easier. The IT group has gone through different iterations, but they are always friendly and responsive. When I can help them, I help them. When I interact with their legal staff, they are very polite. But I rarely interact with them directly. On occasion, they have also given me some very bad advice. (It might be good for them. But, as my own attorney pointed out, it is generally over-reaching in the requested scope.) The upper management that I have interacted with are a pain in the ass. If it wasn't for the CyberTipline, related investigators, and the IT staff, I would have walked away (or minimized my interactions) long ago. Why haven't I made my whitepaper about PhotoDNA public? In my view, who would it help? It would help bad guys avoid detection and it will help malcontents manufacture false-positives. The paper won't help NCMEC, ICACs, or related law enforcement. It won't help victims. About this time, someone usually mocks "it's always about the kids, think about the kids." To those critics: They have not seen the scope of this problem or the long term impact. There is nearly a 1-to-1 relationship between people who deal in CP and people who abuse children. And they rarely victimize just one child. Nearly 1 in 10 children in the US will be sexually abused before the age of 18.
- shkkmo 5y ago
  > Why haven't I made my whitepaper about PhotoDNA public? In my view, who would it help? Would it help activists push for more accurate technology and better management for NCMEC? Would it help technologists come up with better algorithms? I see all kinds of benefits to more openess and accountability here.
- 5y ago
ipv6ipv4 5y ago
One way to interpret the macaque photo is that the database has already been subverted for uses other than catching CP.
- eddyg 5y ago
  Or it’s one of many test images, like EICAR, so people can test and validate the system without using abhorrent images.
  - ipv6ipv4 5y ago
    Sure. Though, it’s not of much use if it is not documented.
intended 5y ago
Isn’t that an alleged memo from the NCMEC? I would sincerely doubt an official memo from any agency would use the term “shrieking minority”, it sounds like imaginative fiction of what a government agency would actually say.
- commoner 5y ago
  9to5Mac published the full message that NCMEC sent to Apple: https://9to5mac.com/2021/08/06/apple-internal-memo-icloud-photo-scanning-concerns/ https://9to5mac.com/2021/08/06/apple-internal-memo-icloud-ph... It does say "We know that the days to come will be filled with the screeching voices of the minority."
  - intended 5y ago
    Wow. Thank you, looks like I was wrong.
    - tgsovlerkhgsel 5y ago
      The fact that they're willing to openly make such a brazen statement is part of why I think they're unsalvageable.
babesh 5y ago
I think there is a trend across the world of power centers becoming more authoritarian and punitive. It is en vogue to see it in China and point them out for it. It is harder to look in the mirror and see something similar happening in the US. In the US, we superficially see government doing it (Snowden disclosures) and then we see corporations doing it separately (Facebook, Google ad tracking, etc...). However, I think government and tech giants are working closely together to act like China. This feels like another bud of this trend. - Social credit system - Loss of financial services (PayPal) - Loss of access to social media (Facebook, Google, Apple, YouTube) - Loss of access to travel related services (AirBnB, travel ban) - Banning of material (Amazon) - Control of media (owned by just a few major corporations who don't have to make money from the media... Comcast basically has a monopoly on land line Internet, AT&T has a very strong position on mobile, Disney has a strong position in films... they own CNN, NBC, and ABC)... EDIT: And let's not forget Fox You can say all you want about freedom of association, but the effect is similar in China and the US. You are ostracized from the system. Tech has lost its neutral carrier status and now is connected into a system that enforces consent. I wonder why? Are we being prepared for an economic war? Is this the natural evolution of power seeking power? Is this just a cycle of authoritarianism and liberalism? P.S. I don't think groundswell upcry leading to cancellation means much. I am much more concerned when corporations do it. I just think they are much, much more powerful.
axaxs 5y ago
Scary to admit this, but whatever. In my younger years, which coincidentally were also the younger years of the internet, I used to come across... let's say...bad things all the time. Being a decent enough human, I made many reports to NCMEC. Human verified(me) reports. Never once did I hear back. Not even some weird auto-reply. Needless to say, I have zero faith in that agency. Fitting they'd get others to do the work.
r00fus 5y ago
NCMEC is a private nonprofit. No government oversight. How are they allowed this much power over every photo on everyone's devices?

lilSebastian 5y ago

> It also seems like the PhotoDNA hash algorithm is problematic (to the point where it may be possible to trigger false matches A post here some days ago (since removed) linked to a google drive containing generated images (which displayed nonsense), the hashes of which matched those of genuine problems images.

gerash 5y ago

I agree. NCMEC is the root cause. It's very much like the war on drugs. There are a lot of horrendous crimes out there and this level of overreach isn't deemed necessary for any of them. Child sex abuse seems to have become the excuse to create these heavy handed policies to terminate accounts with no recourse by Google and scanning locally stored photos by Apple. Even receiving a cartoon depicting child sex abuse can get you in trouble. Hopefully this will be a catalyst to reform the law.

judge2020 5y ago

> I'm surprised, and honestly disappointed, that the author seems to still play nice Stopping to that level is what they want, CNN: “‘privacy activists’ have released a tool to allow the spread of CP”

zionic 5y ago
If that’s how they play then the only winning move is to respond in kind. >shadowy government affiliated agency abuses its role of protecting children to install malware on a billion devices
- Sebb767 5y ago
  That's not even news at this point. Privacy invading laws have been pushed for years under the guise of either CP or terrorism.
- andrewflnr 5y ago
  That's a PR fight you will lose.
  - throwaway09223 5y ago
    I'm not so sure, I think it may be a lose-lose scenario, with both the government and the companies who's products have become compromised taking a big hit. The people merely avoiding the tainted products aren't on blast here.
    - andrewflnr 5y ago
      The people on blast are the ones publicly advocating for privacy. They're the ones who would be damaged in that scenario, and I for one want a society that takes them seriously.
      - throwaway09223 5y ago
        Well, it doesn't look that way so far. I haven't seen any credible mainstream positions ridiculing the people advocating for privacy. It seems like everyone's pretty well aware that technology sucks and systems like this are not to be trusted, even if they're implemented with good intentions. We will see.

deleted 5y ago

[deleted]

Thorrez 5y ago

>I'm surprised, and honestly disappointed, that the author seems to still play nice, instead of releasing the whitepaper. Would it help anything? Apple isn't using PhotoDNA, so proving PhotoDNA is bad would just be met with "we don't use that".

heavyset_go 5y ago
I believe it would because other image systems will probably have to make similar implementations and trade offs that PhotoDNA did.
- tablespoon 5y ago
  >> Would it help anything? Apple isn't using PhotoDNA, so proving PhotoDNA is bad would just be met with "we don't use that". > I believe it would because other image systems will probably have to make similar implementations and trade offs that PhotoDNA did. Even if that's the case, that's too subtle of a point to be very effective, and you'll have all kinds of PR people (Apple and otherwise) selling the "we don't use that [so those criticisms don't apply to us]" narrative.
- zepto 5y ago
  Why? It would be interesting to compare the two systems, but there is no reason to assume the trade-offs are the same.
  - heavyset_go 5y ago
    There are trade offs that can be made that are inherent to the space. There are a handful of hashing methods in papers, and each can have its parameters tuned, again making trade offs for things like efficiency or accuracy. Then when it comes to efficient searching through hashes for matches and fuzzy matches, there are common algorithms and data structures used across perceptual hashing systems, each with with their own trade offs, implementation details and parameters that can be tuned. If there's an issue with PhotoDNA that doesn't come down to a poor implementation, then there's a good chance that other systems might have met the same pitfalls they did. And if it comes down to a poor implementation, it would be prudent for operators of other systems to make sure their own systems don't make the same mistakes.

zionic 5y ago

It’s not enough to disband the NCMEC, I want jail time for these people. This is literally conspiracy to undermine the privacy and security of over a billion devices (and their users) to catch a “small minority” of criminals. These people deserve to lose their homes and freedom for this, along with every engineer and executive that participated.

nyx-aiur 5y ago
wtf. are you OK? Your whole comment history looks like a guy diving in a really bad conspiracy rabbit hole.

hackerfactor1 5y ago

> I'm surprised, and honestly disappointed, that the author seems to still play nice, instead of releasing the whitepaper. I'm the author. I've worked with different parts of NCMEC for years. (I built the initial FotoForensics service in a few days. Before I wrote the first line of code, I was in phone calls with NCMEC about my reporting requirements.) Over time, this relationship grew. Some years, I was in face-to-face development discussions, other times it have been remote communications. To me, there are different independent parts working inside NCMEC. The CyberTipline and their internal case staff are absolutely incredible. They see the worst of people in the media and reports that they process. They deal with victims and families. And they remain the kindest and most sincere people I've ever encountered. When possible, I will do anything needed to make their job easier. The IT group has gone through different iterations, but they are always friendly and responsive. When I can help them, I help them. When I interact with their legal staff, they are very polite. But I rarely interact with them directly. On occasion, they have also given me some very bad advice. (It might be good for them. But, as my own attorney pointed out, it is generally over-reaching in the requested scope.) The upper management that I have interacted with are a pain in the ass. If it wasn't for the CyberTipline, related investigators, and the IT staff, I would have walked away (or minimized my interactions) long ago. Why haven't I made my whitepaper about PhotoDNA public? In my view, who would it help? It would help bad guys avoid detection and it will help malcontents manufacture false-positives. The paper won't help NCMEC, ICACs, or related law enforcement. It won't help victims. About this time, someone usually mocks "it's always about the kids, think about the kids." To those critics: They have not seen the scope of this problem or the long term impact. There is nearly a 1-to-1 relationship between people who deal in CP and people who abuse children. And they rarely victimize just one child. Nearly 1 in 10 children in the US will be sexually abused before the age of 18.

shkkmo 5y ago
> Why haven't I made my whitepaper about PhotoDNA public? In my view, who would it help? Would it help activists push for more accurate technology and better management for NCMEC? Would it help technologists come up with better algorithms? I see all kinds of benefits to more openess and accountability here.
5y ago

ipv6ipv4 5y ago

One way to interpret the macaque photo is that the database has already been subverted for uses other than catching CP.

eddyg 5y ago
Or it’s one of many test images, like EICAR, so people can test and validate the system without using abhorrent images.
- ipv6ipv4 5y ago
  Sure. Though, it’s not of much use if it is not documented.

intended 5y ago

Isn’t that an alleged memo from the NCMEC? I would sincerely doubt an official memo from any agency would use the term “shrieking minority”, it sounds like imaginative fiction of what a government agency would actually say.

commoner 5y ago
9to5Mac published the full message that NCMEC sent to Apple: https://9to5mac.com/2021/08/06/apple-internal-memo-icloud-photo-scanning-concerns/ https://9to5mac.com/2021/08/06/apple-internal-memo-icloud-ph... It does say "We know that the days to come will be filled with the screeching voices of the minority."
- intended 5y ago
  Wow. Thank you, looks like I was wrong.
  - tgsovlerkhgsel 5y ago
    The fact that they're willing to openly make such a brazen statement is part of why I think they're unsalvageable.

babesh 5y ago

I think there is a trend across the world of power centers becoming more authoritarian and punitive. It is en vogue to see it in China and point them out for it. It is harder to look in the mirror and see something similar happening in the US. In the US, we superficially see government doing it (Snowden disclosures) and then we see corporations doing it separately (Facebook, Google ad tracking, etc...). However, I think government and tech giants are working closely together to act like China. This feels like another bud of this trend. - Social credit system - Loss of financial services (PayPal) - Loss of access to social media (Facebook, Google, Apple, YouTube) - Loss of access to travel related services (AirBnB, travel ban) - Banning of material (Amazon) - Control of media (owned by just a few major corporations who don't have to make money from the media... Comcast basically has a monopoly on land line Internet, AT&T has a very strong position on mobile, Disney has a strong position in films... they own CNN, NBC, and ABC)... EDIT: And let's not forget Fox You can say all you want about freedom of association, but the effect is similar in China and the US. You are ostracized from the system. Tech has lost its neutral carrier status and now is connected into a system that enforces consent. I wonder why? Are we being prepared for an economic war? Is this the natural evolution of power seeking power? Is this just a cycle of authoritarianism and liberalism? P.S. I don't think groundswell upcry leading to cancellation means much. I am much more concerned when corporations do it. I just think they are much, much more powerful.

axaxs 5y ago

Scary to admit this, but whatever. In my younger years, which coincidentally were also the younger years of the internet, I used to come across... let's say...bad things all the time. Being a decent enough human, I made many reports to NCMEC. Human verified(me) reports. Never once did I hear back. Not even some weird auto-reply. Needless to say, I have zero faith in that agency. Fitting they'd get others to do the work.

r00fus 5y ago

NCMEC is a private nonprofit. No government oversight. How are they allowed this much power over every photo on everyone's devices?