5 ms·

> any company storing images on their infrastructure in the US must report pedophilic images to the US government Ones they know of… > What other technical ap

> any company storing images on their infrastructure in the US must report pedophilic images to the US government Ones they know of… > What other technical approach are people advocating for? Apple already has a technical solution, encryption.

ashildr 5y ago
Encryption does not help, Apple still is responsible. If Apple intends to let the user store photos in iCloud (or send by imessage) encrypted, they either have to keep the keys, so they can decrypt and scan the photos or or to keep the user from uploading incriminating content. Apple found a third way: they will only get to reconstruct the keys if the user uploads too many pictures triggering alarms.
- adambatkin 5y ago
  Source? I am not aware of a law in the US that requires Apple to actively scan images, or to store them unencrypted (or keep copies of the keys).
  - hef19898 5y ago
    The US aren't the only government with a stake in that. And countries like China, Saudi, the Emirates have a lot of leverage. Financially and diplomatic. Heck, Facebook bowed to Myanmar just to get the users there.
  - nicce 5y ago
    Every cloud infrastructure holder is required for doing that. Closing an eye does not take a duty away. You must be actively pursuing that. Encryption would start flood of new laws https://www.govinfo.gov/app/details/USCODE-2011-title18/USCODE-2011-title18-partI-chap110-sec2258A/summary https://www.govinfo.gov/app/details/USCODE-2011-title18/USCO...
    - ryanlol 5y ago
      Those laws do not exist (yet?). You can’t justify this as a compliance measure for legislation that does not exist.
      - nicce 5y ago
        Yes, but current laws also restrict storing images as E2E encrypted, so there is dilemma?
        ryanlol 5y ago
        Where are you getting this from? That’s simply not true. It’s perfectly legal to “store images as E2E encrypted”
        nicce 5y ago
        Encryption itself is not illegal, but it might make harder to comply other legal requirements. I have just heard this many times, and now I read the whole law (curse me). It says on 2258Af part especially that there is no requirement to find evidence of CSAM material all the time. However, if NCMEC especially shares some information about visual depictions and asks to stop redistribution, then provider is required to comply in some cases. For example if they share hashes and these should be stopped. To be able to stop this data, then search is required and complying this with E2E encryption is not possible.
        pseudalopex 5y ago
        Please show where those legal requirements have been applied to E2E encrypted files.
    - skinkestek 5y ago
      Tarsnap exists so either it is legal when done right or tarsnap is a walking dead and I haven't heard anything to that effect from any credible source.
zepto 5y ago
> Apple already has a technical solution, encryption. How does encryption help prevent porn being sent to pre-teens?
- ryanlol 5y ago
  That’s a completely different feature than the one we’re discussing. These things were announced together, but they are not the same. Nobody is objecting to opt-in clientside content filtering.
  - zepto 5y ago
    Both of the features involve opt-in client side content filtering. The only objections are to that.
    - ryanlol 5y ago
      The CSAM scanning is not opt-in. Sure, you could stop using iCloud. That’s opt-out.
      - zepto 5y ago
        That’s not correct. This applies only to iCloud Photo Library, not to iCloud as a whole. iCloud Photo Library is an optional feature, and there are numerous alternatives.
        ryanlol 5y ago
        Doesn’t matter, it’s still opt-out if you were using iCloud Photo Library before these features were announced. It’s really ridiculous to try to call this “opt-in”.
        zepto 5y ago
        I was using iCloud Photo Library before this was announced. None of my photos have been scanned, nor ever will be unless I choose for them to be. I don’t have to do anything to achieve this. They won’t scan anything unless I decide to go ahead. That is the very meaning of opt-in. Opt-out typically means that someone will go ahead with something unless you decline. This is not that. I do agree that if I don’t want on device scanning in future, I will need to choose another could photo service, but in the meantime, nothing will be scanned without me taking positive action to initiate it.

ashildr 5y ago

Encryption does not help, Apple still is responsible. If Apple intends to let the user store photos in iCloud (or send by imessage) encrypted, they either have to keep the keys, so they can decrypt and scan the photos or or to keep the user from uploading incriminating content. Apple found a third way: they will only get to reconstruct the keys if the user uploads too many pictures triggering alarms.

adambatkin 5y ago
Source? I am not aware of a law in the US that requires Apple to actively scan images, or to store them unencrypted (or keep copies of the keys).
- hef19898 5y ago
  The US aren't the only government with a stake in that. And countries like China, Saudi, the Emirates have a lot of leverage. Financially and diplomatic. Heck, Facebook bowed to Myanmar just to get the users there.
- nicce 5y ago
  Every cloud infrastructure holder is required for doing that. Closing an eye does not take a duty away. You must be actively pursuing that. Encryption would start flood of new laws https://www.govinfo.gov/app/details/USCODE-2011-title18/USCODE-2011-title18-partI-chap110-sec2258A/summary https://www.govinfo.gov/app/details/USCODE-2011-title18/USCO...
  - ryanlol 5y ago
    Those laws do not exist (yet?). You can’t justify this as a compliance measure for legislation that does not exist.
    - nicce 5y ago
      Yes, but current laws also restrict storing images as E2E encrypted, so there is dilemma?
      - ryanlol 5y ago
        Where are you getting this from? That’s simply not true. It’s perfectly legal to “store images as E2E encrypted”
        nicce 5y ago
        Encryption itself is not illegal, but it might make harder to comply other legal requirements. I have just heard this many times, and now I read the whole law (curse me). It says on 2258Af part especially that there is no requirement to find evidence of CSAM material all the time. However, if NCMEC especially shares some information about visual depictions and asks to stop redistribution, then provider is required to comply in some cases. For example if they share hashes and these should be stopped. To be able to stop this data, then search is required and complying this with E2E encryption is not possible.
        pseudalopex 5y ago
        Please show where those legal requirements have been applied to E2E encrypted files.
  - skinkestek 5y ago
    Tarsnap exists so either it is legal when done right or tarsnap is a walking dead and I haven't heard anything to that effect from any credible source.

zepto 5y ago

> Apple already has a technical solution, encryption. How does encryption help prevent porn being sent to pre-teens?

ryanlol 5y ago
That’s a completely different feature than the one we’re discussing. These things were announced together, but they are not the same. Nobody is objecting to opt-in clientside content filtering.
- zepto 5y ago
  Both of the features involve opt-in client side content filtering. The only objections are to that.
  - ryanlol 5y ago
    The CSAM scanning is not opt-in. Sure, you could stop using iCloud. That’s opt-out.
    - zepto 5y ago
      That’s not correct. This applies only to iCloud Photo Library, not to iCloud as a whole. iCloud Photo Library is an optional feature, and there are numerous alternatives.
      - ryanlol 5y ago
        Doesn’t matter, it’s still opt-out if you were using iCloud Photo Library before these features were announced. It’s really ridiculous to try to call this “opt-in”.
        zepto 5y ago
        I was using iCloud Photo Library before this was announced. None of my photos have been scanned, nor ever will be unless I choose for them to be. I don’t have to do anything to achieve this. They won’t scan anything unless I decide to go ahead. That is the very meaning of opt-in. Opt-out typically means that someone will go ahead with something unless you decline. This is not that. I do agree that if I don’t want on device scanning in future, I will need to choose another could photo service, but in the meantime, nothing will be scanned without me taking positive action to initiate it.