3 ms·

Your hash will match to say image 105 of the dataset. Upon visual inspection, your 'legal porn' is going to have to at least look passably like image 105 of the

Your hash will match to say image 105 of the dataset. Upon visual inspection, your 'legal porn' is going to have to at least look passably like image 105 of the dataset to get anywhere. So at this point we have an image that computers think is CSAM and people think is CSAM, and when held up next to the original verified horrific image everyone agrees is the same image. At this point, someone is going to ask, rightly so, where that came from. In order to generate this attack, you have had to go out and procure, deliberately, known CSAM. Ignoring that it would be easier just to send that to the target, rather than hiring talent to recreate the pose of a specific piece of child porn (or 30 pieces to trigger the reporting levels), the most likely person by orders of magnitude to be prosecuted in this scenario is the attacker.

rlpb 5y ago
> Upon visual inspection, your 'legal porn' is going to have to at least look passably like image 105 of the dataset to get anywhere. Define "get anywhere". Why won't you get raided by the police and have all your devices seized first?
- shapefrog 5y ago
  No, probably wouldnt even get to the desk of the police. End of the road would be NCMEC, to whom apple would refer hash matching images that pass human verification that are close enough to porn. If your 30 or so hash matching images matched their corresponding known CSAM then that goes on to the police and then they knock on your door.
  - rlpb 5y ago
    > to whom apple would refer hash matching images that pass human verification I am under the impression that Apple's scheme allows them only to verify the output of the matching algorithm (the "safety vouchers"), and not the image content itself. So in the hypothetical situation described in the thread, it won't be possible for Apple to detect the false positive, and they could pass on the report to NCMEC. I fear that this will lead to a law enforcement raid without any actual human verification of the offending image itself. If I'm wrong, I welcome citations which demonstrate the opposite.
    - shapefrog 5y ago
      Happy to provide citation of how the apple scheme works [1]. You should also point out that the NCMEC themselves are not law enforcment. [1] https://www.apple.com/child-safety/pdf/CSAM_Detection_Technical_Summary.pdf https://www.apple.com/child-safety/pdf/CSAM_Detection_Techni...
      - rlpb 5y ago
        Right, and what in there suggests to you that Apple can view an image after a sufficient number of images match? I see the opposite: "Apple can’t access metadata or visual derivatives for matched CSAM images until a threshold of matches is exceeded for an iCloud Photos account." That suggests that Apple can't access the actual matched CSAM images at all. > You should also point out that the NCMEC themselves are not law enforcment. I don't think the distinction is relevant. The point is that they will get passed on for enforcement purposes, and at that point, innocent parties will find themselves raided and their devices seized without any human actually manually verifying that it is CSAM first.

rlpb 5y ago

> Upon visual inspection, your 'legal porn' is going to have to at least look passably like image 105 of the dataset to get anywhere. Define "get anywhere". Why won't you get raided by the police and have all your devices seized first?

shapefrog 5y ago
No, probably wouldnt even get to the desk of the police. End of the road would be NCMEC, to whom apple would refer hash matching images that pass human verification that are close enough to porn. If your 30 or so hash matching images matched their corresponding known CSAM then that goes on to the police and then they knock on your door.
- rlpb 5y ago
  > to whom apple would refer hash matching images that pass human verification I am under the impression that Apple's scheme allows them only to verify the output of the matching algorithm (the "safety vouchers"), and not the image content itself. So in the hypothetical situation described in the thread, it won't be possible for Apple to detect the false positive, and they could pass on the report to NCMEC. I fear that this will lead to a law enforcement raid without any actual human verification of the offending image itself. If I'm wrong, I welcome citations which demonstrate the opposite.
  - shapefrog 5y ago
    Happy to provide citation of how the apple scheme works [1]. You should also point out that the NCMEC themselves are not law enforcment. [1] https://www.apple.com/child-safety/pdf/CSAM_Detection_Technical_Summary.pdf https://www.apple.com/child-safety/pdf/CSAM_Detection_Techni...
    - rlpb 5y ago
      Right, and what in there suggests to you that Apple can view an image after a sufficient number of images match? I see the opposite: "Apple can’t access metadata or visual derivatives for matched CSAM images until a threshold of matches is exceeded for an iCloud Photos account." That suggests that Apple can't access the actual matched CSAM images at all. > You should also point out that the NCMEC themselves are not law enforcment. I don't think the distinction is relevant. The point is that they will get passed on for enforcement purposes, and at that point, innocent parties will find themselves raided and their devices seized without any human actually manually verifying that it is CSAM first.