4 ms·

> This is an area we’ve been looking at for some time, including current state of the art techniques which mostly involves scanning through entire contents of u

> This is an area we’ve been looking at for some time, including current state of the art techniques which mostly involves scanning through entire contents of users’ libraries on cloud services that — as you point out — isn’t something that we’ve ever done; to look through users’ iCloud Photos. https://techcrunch.com/2021/08/10/interview-apples-head-of-privacy-details-child-abuse-detection-and-messages-safety-features/ https://techcrunch.com/2021/08/10/interview-apples-head-of-p... > This moment calls for public discussion, and we want our customers and people around the country to understand what is at stake. - Tim Cook, Apple At what point does the fact that half a decade has passed since those words were written yet the hacker community has made little contribution to that discourse about the importance of privacy start implicating us in the collective failure to act?

hypothesis 5y ago
And yet we can go e.g. on Twitter and observe comments from relevant security researchers that appear to describe a chilling atmosphere surrounding privacy research, including resistance to even consider white paper. That’s not my area of expertise and don’t know how to fix that, but that should be an important consideration.
new299 5y ago
> The voucher generation is actually exactly what enables us not to have to begin processing all users’ content on our servers, which we’ve never done for iCloud Photos. I really dislike this statement. It's likely designed to be "technically true". But it's been reported elsewhere that they do scan iCloud content: https://nakedsecurity.sophos.com/2020/01/09/apples-scanning-icloud-photos-for-child-abuse-images/ https://nakedsecurity.sophos.com/2020/01/09/apples-scanning-... Perhaps they scan as the data is being ingested. Perhaps it's scanned on a third party server. But it seems clear that it is being scanned.
- shuckles 5y ago
  My understanding based on piecing together the various poorly cited news stories is that Apple used to scan iCloud Mail for this material, and that’s it.
  - new299 5y ago
    If you have references to also help me piece this together I'd find that really helpful.
    - selsta 5y ago
      > Last year, for instance, Apple reported 265 cases to the National Center for Missing & Exploited Children, while Facebook reported 20.3 million According to [1] it does seem like Apple didn't do any wide scale scanning of iCloud Data. [1] https://www.nytimes.com/2021/08/05/technology/apple-iphones-privacy.html https://www.nytimes.com/2021/08/05/technology/apple-iphones-...
      - new299 5y ago
        If they weren't doing any scanning why would they find any to report? The data is encrypted as rest so... why would they find any to report. This clearly doesn't include search requests [1]. iCloud has perhaps 25% of the users of Facebook. Of that 25% it's not clear how many actively use the platform of backups/photos. iCloud is not a platform for sharing content like Facebook. So how many reports should we expect to see from Apple? It's unclear to me. So, I'm not saying the number isn't suspiciously low. But it doesn't really clarify what's going on to me... [1] https://www.apple.com/legal/transparency/pdf/requests-2018-H2-en.pdf https://www.apple.com/legal/transparency/pdf/requests-2018-H...
    - shuckles 5y ago
      Forbes had the only evidence based reporting where they cited a court case where Apple automatically detected known CSAM in attachments to iCloud Mail: https://www.forbes.com/sites/thomasbrewster/2020/02/11/how-apple-intercepts-and-reads-emails-when-it-finds-child-abuse https://www.forbes.com/sites/thomasbrewster/2020/02/11/how-a... Everyone else is making inferences from a chance to their privacy policy and a statement made by a company lawyer.
- zepto 5y ago
  That link doesn’t confirm that they have already been doing it. Just that they changed an EULA.
- dwaite 5y ago
  https://www.forbes.com/sites/thomasbrewster/2020/02/11/how-apple-intercepts-and-reads-emails-when-it-finds-child-abuse/ https://www.forbes.com/sites/thomasbrewster/2020/02/11/how-a... My interpretation is Sophos got it wrong (they don't give a quote from the Apple Officer involved and manage to have a typo in the headline). Apple does scanning of data which is not encrypted, such as received and sent email over SMTP. They presumably at that time were using PhotoDNA to scan attachments by hash. This is likely what Apple was actually talking about back at CES 2020. They may have been also scanning public iCloud photo albums, but I haven't seen anyone discuss that one way or another.

hypothesis 5y ago

And yet we can go e.g. on Twitter and observe comments from relevant security researchers that appear to describe a chilling atmosphere surrounding privacy research, including resistance to even consider white paper. That’s not my area of expertise and don’t know how to fix that, but that should be an important consideration.

new299 5y ago

> The voucher generation is actually exactly what enables us not to have to begin processing all users’ content on our servers, which we’ve never done for iCloud Photos. I really dislike this statement. It's likely designed to be "technically true". But it's been reported elsewhere that they do scan iCloud content: https://nakedsecurity.sophos.com/2020/01/09/apples-scanning-icloud-photos-for-child-abuse-images/ https://nakedsecurity.sophos.com/2020/01/09/apples-scanning-... Perhaps they scan as the data is being ingested. Perhaps it's scanned on a third party server. But it seems clear that it is being scanned.

shuckles 5y ago
My understanding based on piecing together the various poorly cited news stories is that Apple used to scan iCloud Mail for this material, and that’s it.
- new299 5y ago
  If you have references to also help me piece this together I'd find that really helpful.
  - selsta 5y ago
    > Last year, for instance, Apple reported 265 cases to the National Center for Missing & Exploited Children, while Facebook reported 20.3 million According to [1] it does seem like Apple didn't do any wide scale scanning of iCloud Data. [1] https://www.nytimes.com/2021/08/05/technology/apple-iphones-privacy.html https://www.nytimes.com/2021/08/05/technology/apple-iphones-...
    - new299 5y ago
      If they weren't doing any scanning why would they find any to report? The data is encrypted as rest so... why would they find any to report. This clearly doesn't include search requests [1]. iCloud has perhaps 25% of the users of Facebook. Of that 25% it's not clear how many actively use the platform of backups/photos. iCloud is not a platform for sharing content like Facebook. So how many reports should we expect to see from Apple? It's unclear to me. So, I'm not saying the number isn't suspiciously low. But it doesn't really clarify what's going on to me... [1] https://www.apple.com/legal/transparency/pdf/requests-2018-H2-en.pdf https://www.apple.com/legal/transparency/pdf/requests-2018-H...
  - shuckles 5y ago
    Forbes had the only evidence based reporting where they cited a court case where Apple automatically detected known CSAM in attachments to iCloud Mail: https://www.forbes.com/sites/thomasbrewster/2020/02/11/how-apple-intercepts-and-reads-emails-when-it-finds-child-abuse https://www.forbes.com/sites/thomasbrewster/2020/02/11/how-a... Everyone else is making inferences from a chance to their privacy policy and a statement made by a company lawyer.
zepto 5y ago
That link doesn’t confirm that they have already been doing it. Just that they changed an EULA.
dwaite 5y ago
https://www.forbes.com/sites/thomasbrewster/2020/02/11/how-apple-intercepts-and-reads-emails-when-it-finds-child-abuse/ https://www.forbes.com/sites/thomasbrewster/2020/02/11/how-a... My interpretation is Sophos got it wrong (they don't give a quote from the Apple Officer involved and manage to have a typo in the headline). Apple does scanning of data which is not encrypted, such as received and sent email over SMTP. They presumably at that time were using PhotoDNA to scan attachments by hash. This is likely what Apple was actually talking about back at CES 2020. They may have been also scanning public iCloud photo albums, but I haven't seen anyone discuss that one way or another.