13 ms·

Policy groups ask Apple to drop plans to inspect messages, scan for abuse images

296 points by arkadiyt 5y ago

arthurcolle 5y ago
Apple did this in such a myopic, I want to say almost comically stupid manner. Craig's interview in and of itself was the biggest indictment of technology companies one could ever hope for. Dude literally stumbles as he says "multi-step algorithm" as if the world is being graced by his bountiful excellence. Can't believe this dude is running software at Apple. The headline for all of this should be "We know what it does and we don't want it"
- istingray 5y ago
  I'm waiting for betting odds of Apple rolling this back to pop up on polymarket https://polymarket.com/ https://polymarket.com/
- hypothesis 5y ago
  > "We know what it does and we don't want it" And that interview is likely supposed to telegraph that they “don’t care”. It wasn’t a live one, was it? They could have improved parts of it if they wanted.
- SilverRed 5y ago
  All of the PR out of Apple seems to assume that people simply do not understand how it works and if they did they would feel better. Everyone understands well enough how it works and understands how trivially it could be changed to search for other kinds of content.
  - Animats 5y ago
    Right. At some point, the back story behind this will leak out. That will be interesting. This has to be something Apple was asked/pressured/ordered to do. As a business activity it makes no sense. Bear in mind that over the last week, people in Afghanistan have been frantically trying to erase any evidence of doing things the Taliban doesn't like, such as women playing sports.
    - jjcon 5y ago
      I’m inclined to believe it was a quid-pro-quo (or a play at it). Apple inserts a little back door, in exchange the antitrust case against them will be eased.
      - unityByFreedom 5y ago
        That sounds too corrupt to be believed. If someone came out with evidence of that it would completely blow such a deal.
      - hughrr 5y ago
        Based on the letter by NCMEC describing opponents to the technology as “screeching voices of the minority”, I suspect this is some kind of variant of being guilted into doing something by either lobbying, marketing or internal proponents. This resulted in a tone deaf death march and now they’re trying to work out how to spin it. This is a fairly typical corporate failure mode. Sometimes the best thing is to do nothing as they have found out because now they’re stuck in a position where the two exits are either piss off everyone by writing off their privacy stance or piss off everyone else for canning child porn scanning. What a complete fuck up.
      - michelb 5y ago
        I'm convinced none of these conspiracy theories hold up. This is a typical Apple thing. Thought long and hard about something in a mostly isolated setting and then missing some obvious things.
        hdjjhhvvhga 5y ago
        You might be right. On the other hand, all their past controversial ideas were reasonable from the financial point of view: introduce non-standard connectors, remove the minijack, make the hardware non-upgradeable and so on. All these things were bad for consumers, but good for Apple's bottom line. This one is bad for everybody. Apple's management is not stupid, they must have a good reason.
    - unityByFreedom 5y ago
  - kgwxd 5y ago
    Gaslighting is the term. From the first instance any one/entity uses it, trust should be over, forever, never to be regained.
  - ilogik 5y ago
    can someone please explain to me what is this scary scenario where this is being misused? Am I the only one that isn't seeing it?
    - zimpenfish 5y ago
      The scanning matches against CSAM hashes provided by NCMEC - the fear is that NCMEC will be pressured into including hashes of non-CSAM material that USGOV want to track as well (say MAGA images for the current administration.) (One counterpoint to this is that PhotoDNA has been used for scanning cloud images using NCMEC-provided hashes for a decade now and this slippery slope doesn't seem to have happened yet.)
      - ilogik 5y ago
        this is a very weak argument. The MAGA crowd has been posting images all over social media. My understanding is that there is a threshold that needs to be met, and then an Apple employee with a very difficult job will need to confirm the image. So even if NCMEC get pressured, I don't see what the result can be.
        tjpnz 5y ago
        That Apple employee (assuming the role doesn't get contracted out) has no incentive to protect you or me. But they'll absolutely err on the side of caution to protect their own livelihood.
        ilogik 5y ago
        and what's the next step? FBI breaks down my door because I said something bad about Biden?
        umanwizard 5y ago
        Something like that is unlikely to happen because the US is not — for now — an authoritarian state. Replace “FBI” and “Biden” with their equivalents in various other countries and yes, it’s absolutely plausible.
  - varispeed 5y ago
    > Everyone understands well enough how it works and understands how trivially it could be changed to search for other kinds of content. I think it's not really a problem of what is being looked for, but the mere fact that it will be done without a warrant on a personal device.
- zepto 5y ago
  If you read the letter, if’s clear that whoever wrote it has little understanding of what it does. There are good reasons not to want this. Just not making everyone into a suspect would be a start. But whoever wrote the letter is clueless.
  - elisbce 5y ago
    This part is legit though: governments around the world could pressure Apple to add other forms of surveillance. Be it hashes of non-CSAM, or simply pressure NEMEC or other hash providers, or extending its capabilities to all messages or photos on device. In my opinion, this is the biggest concern, not the technology. Before, Apple could simply refuse by saying we don't have the capabilities. But now, that excuse is gone. Apple's promise to human review content and only report CSAM is the weakest link.
    - zepto 5y ago
      > governments around the world could pressure Apple to add other forms of surveillance. What do they have now that they didn’t have before?
    - karlshea 5y ago
      If you read their Security Threat Model Review [1] they're only using the "intersection of hashes provided by at least two child safety organizations operating in separate sovereign jurisdictions". So you'd have to pressure NEMEC and another org under a different government to both add the non-CSAM hash, plus Apple would need to be pressured to verify a non-CSAM derivative image, plus you'd need other hash matches on-device to exceed the threshold before they could even do the review in the first place (they can't even tell if there was a match unless the threshold is exceeded). I get why people are concerned, but between this thread and the other thread yesterday it's clear that pretty much everyone discussing this has no idea how it works. 1: https://www.apple.com/child-safety/pdf/Security_Threat_Model_Review_of_Apple_Child_Safety_Features.pdf https://www.apple.com/child-safety/pdf/Security_Threat_Model...
      - 5y ago
- rjzzleep 5y ago
  My initial response was that maybe that's why Apples software development has gone down in quality so much in the recent years. But then again he's been leading it since 2009 so maybe not. But it's definitely around the same time that they started removing programmability from the core os. https://www.apple.com/leadership/craig-federighi/ https://www.apple.com/leadership/craig-federighi/
  - arthurcolle 5y ago
    I deeply hope that he gets pushed out because of this. The skeuomorphism guy was definitely horrible and obviously was the cause of many assaults upon the senses, but this CSAM spyware scandal was such an affront on all that democratic, enlightened society holds close to the chest. There are so many more talented software development leaders out there (maybe scratch all the ones working on adtech), but he's clearly a cultural troglodyte and this is evidence that he is incapable of actually leading the future engineers and software workers of the world. If I saw him in a social setting I would try to ask him how he lives with himself, actively enabling the potential future dystopia and being incapable of defending the actual impetus of his actions, much less the reaction to it. Truly unforgivable, especially in an age of increased social fragmentation.
    - rjzzleep 5y ago
      > If I saw him in a social setting I would try to ask him how he lives with himself, actively enabling the potential future dystopia and being incapable of defending the actual impetus of his actions, much less the reaction to it. Truly unforgivable, especially in an age of increased social fragmentation. He seems like a guy who genuinely believe that what he's doing is a net positive for society and that society should just leave things in his hands. There are plenty of people like that at google last I remember. I used to go to the google dev day and the was no greater difference between really talented technical people presenting interesting things and engineering leadership believe that everyone should just have a dumb terminal in their hand and that google should do any processing and how that would be so much better for society.
- beckman466 5y ago
  > Craig's interview in and of itself was the biggest indictment of technology companies one could ever hope for. Dude literally stumbles as he says "multi-step algorithm" Anybody a link?
  - arthurcolle 5y ago
    https://www.youtube.com/watch?v=OQUO1DSwYN0&ab_channel=WallStreetJournal https://www.youtube.com/watch?v=OQUO1DSwYN0&ab_channel=WallS... Here you go
  - anshumankmr 5y ago
    https://www.wsj.com/video/series/joanna-stern-personal-technology/apples-software-chief-explains-misunderstood-iphone-child-protection-features-exclusive/573D76B3-5ACF-4C87-ACE1-E99CECEFA82C https://www.wsj.com/video/series/joanna-stern-personal-techn...
- labster 5y ago
  I’m starting to wonder if this is Apple’s strategy all along. They’ve had pressure for years from law enforcement to abuse their monopoly power to invade people's privacy. So they implement it in a relatively naive approach and sell in a hamfisted way, so that everyone turns against them for a little while. Apple backs off, and every time after this they point law enforcement to this debacle. See, we can’t help you, our customers wouldn’t tolerate it! Not sure if it’s true or not, but we shouldn’t assume companies always intend their public plans to succeed. Maybe they actually want a high profile retreat — it could certainly save them development time down the road by not implementing government misfeatures.
  - JumpCrisscross 5y ago
    > they actually want a high profile retreat Still incompetent. This would have made sense under another administration. The only thing holding back the antitrust dogs is public opinion. An Apple antitrust case would be politically costly in a way a Facebook case wouldn't. This type of thing corrodes the core of the pro-Apple vocal minority. It's bad GR, if that was the plan.
    - cryptonector 5y ago
      The average joe doesn't care about antitrust.
      - JumpCrisscross 5y ago
        > average joe doesn't care about antitrust Neither do they about privacy.
        cryptonector 5y ago
        They almost certainly care more about privacy. Enough more? No. But when horror stories start filtering out they'll care more, even if it is too late.
    - arthurcolle 5y ago
- scrps 5y ago
  The second the world realized those weird nerds no one paid any attention to were gold mines was the beginning of the end. Whatever values we held as hackers, engineers, scientists is now subservient to the monied powers who could never figure any of this out on their own but are exceptionally skilled at convincing or threatening everyone into dancing to the beat of their own self interest. Stop feeding them and they will starve on their ignorance. I'd rather be poor in a better world than rich in a dystopia.
  - varispeed 5y ago
    > I'd rather be poor in a better world than rich in a dystopia. The problem is that we all end up being poor in a dystopia. The regulatory capture of industries is an ongoing thing. When 20 years ago you could start your own business in your garage, without substantial capital, today you are dependent on "Angel investors" and bank loans, which is an equivalent of having to be referred into a "club". If you can't find an investor, it will take you a lifetime to save money to start a business, if you are lucky. Take notice that all taxation is being shifted to workers to limit their chances of raising capital and creating competition.
- Clubber 5y ago
  The "screeching minority" memo gives some insight. Let me break it down line by line. This is just my personal opinion as an external observer; I have no actual insight into what was going on. Team Apple, This is from someone outside the Apple ecosystem that management brought in and gave a lot of credence to. I wanted to share a note of encouragement to say that everyone at NCMEC is SO PROUD of each of you and the incredible decisions you have made in the name of prioritizing child protection. The recipients of this memo didn't make any of the decisions and those were foisted on them by management who in turn were heavily influenced by this person/organization. As to why management was so heavily influenced, I have no idea. This is an attempt to get buy-in from Apple employees I suspect, or at least to ease their concerns. "Don't worry, you are doing the right thing." It’s been invigorating for our entire team to see (and play a small role in) what you unveiled today. The team they are referring to are the ones that pushed for the implementation for child protection. The recipients did all the work because management told them to. I know it’s been a long day and that many of you probably haven’t slept in 24 hours. We know that the days to come will be filled with the screeching voices of the minority. This is the big quote. The author knew what this would do, and knows the tarnish the Apple brand is about to go through, but is trying to convince the audience that it's only a small group of people who will reject this and it will pass over. For the author, the ends justify any means because they are probably personally emotionally traumatized by child porn (rightfully so). Once this happens though, any rationality about consequence of action goes out the window. This is an attempt to get everyone concerned on the same level of ends-justify-the-means with the author. I don't know if the author believes this is just a temporary outrage or not. I suspect not. It doesn't really matter though the author got what they wanted, Apple brand be damned. Our voices will be louder. This obviously isn't the case. Not sure if the author means their organization or their organization + Apple. Either way, the counter resistance to this has been pretty minimal. They left Apple hang out to dry it seems. Our commitment to lift up kids who have lived through the most unimaginable abuse and victimizations will be stronger. During these long days and sleepless nights, I hope you take solace in knowing that because of you many thousands of sexually exploited victimized children will be rescued, and will get a chance at healing and the childhood they deserve. This is the emotional sell, or "for the children." It's also a difficult bridge to reason across; comparing the possession of pictures and the manufacture of pictures as the same thing. Obviously the hash compare only finds existing manufactured pictures, so I don't see how it will protect children from any abuse that hasn't already occurred. Not only is this an emotional sell, it's a lie. Thank you for finding a path forward for child protection while preserving privacy. The final emotional pitch directed at people at Apple typically concerned with privacy. They aren't really protecting children and they also aren't preserving privacy. It's a boondoggle. In closing, "for the children," is almost always a trap. It was used when I was a kid to mass incarcerate Americans that had drug problems, many of them the children they were protecting. It's typically done in an any-means-necessary heavy handed manner, as seen here. I don't condone child pornography in any way. I have never seen child pornography and hope to never see it. At the same time, what they are doing is the road to hell paved with good intentions seemingly by people who are so traumatized (based on their work) that they can't see the collateral damage they are doing.
- goldcd 5y ago
  I genuinely think it's intentional - Apple want to be stopped. Rather than fighting small battles to defend privacy, just take a hyperbolic extreme and use the backlash to bolster their actual position. (or I geuninely think they have lost their f'in minds)
istingray 5y ago
Here's the link to the open letter from the policy group (PDF): https://cdt.org/wp-content/uploads/2021/08/CDT-Coalition-ltr-to-Apple-19-August-2021.pdf https://cdt.org/wp-content/uploads/2021/08/CDT-Coalition-ltr...
JumpCrisscross 5y ago
Do we know who within Apple is pushing for this?
- istingray 5y ago
  In the crazy universe where Apple rolls this back, what does it look like? Cook resigns? Craig? Team is sacked?
  - PopePompus 5y ago
    Nobody needs to resign. Nobody needs to be sacked. They just need to acknowledge the mistake and not push the spyware update.
    - EGreg 5y ago
      Yeah I still remember Scott Forstall being pushed out over the Apple Maps failures. And that is how Jony Ive came to take over both hardware and software design, leading to the end of skeumorphic design that Jobs loved so much - and made the iPhone so unique. Now Apple’s just a follower…
      - stackbutterflow 5y ago
        >leading to the end of skeumorphic design that Jobs loved so much Jobs loved the end of skeumorphic design or Jobs loved skeumorphic design?
        dkdbejwi383 5y ago
        Loved it, apparently. https://www.businessinsider.com/steve-jobss-signature-design-style-2014-10 https://www.businessinsider.com/steve-jobss-signature-design...?
      - nebula8804 5y ago
        I heard he was pushed out not due to the failure but that he refused to improve and accept the mistakes that he made. It pissed off Tim Cook who was already mad that he apparently couldn't work with the other team members well. Take all this with a grain of salt. I wonder if Jobs was just good at managing these brash personalities together.
endisneigh 5y ago
Apple will not drop their plans. Google and Facebook are already doing this. Be happy at least Apple’s implementation happens client side and therefore can preserve end to end encryption. https://transparencyreport.google.com/child-sexual-abuse-material/reporting?hl=en https://transparencyreport.google.com/child-sexual-abuse-mat... https://www.facebook.com/safety/onlinechildprotection https://www.facebook.com/safety/onlinechildprotection https://www.microsoft.com/en-us/photodna https://www.microsoft.com/en-us/photodna https://blog.flickr.net/en/2021/04/16/keeping-flickr-and-children-safe/ https://blog.flickr.net/en/2021/04/16/keeping-flickr-and-chi... Most companies dealing with photos have had this in place for almost a decade now. The FUD and slippery slope arguments are getting old.
- Bilal_io 5y ago
  > Be happy Just because the bar is so low does not mean we have to accept privacy abuse.
  - endisneigh 5y ago
    You don’t have to accept it. Don’t use iCloud, no problem.
    - deleted 5y ago
      [deleted]
- brendoelfrendo 5y ago
  > Be happy at least Apple’s implementation happens client side and therefore can preserve end to end encryption potentially. No, why would I be happy with this? I actually prefer the alternative: scan photos server side, fine. That's Apple's computer and if I send my photos there, then I can't justifiably argue against that. But my device shouldn't be part of their attempt to appease law enforcement by turning the world into a dragnet.
  - endisneigh 5y ago
    If you don’t send your photos this doesn’t affect you in any way.
jitl 5y ago
What if this is four-dimensional chess by Apple: maybe they deliberately announced this back door, just to prove how politically poor the backdoor topic is with the public? Maybe Congress will think twice about trying to force this via legislation on anyone. (This comment is intended as a joke.)
- vegetablepotpie 5y ago
  How could you say that? You have to apply Occam’s razor here, which would say that Apple comically misstepped and nothing more.
  - EGreg 5y ago
    Why would you assume companies are more likely to be unable to think two steps ahead?
    - vegetablepotpie 5y ago
      Because companies are lead by people and people make mistakes.
      - EGreg 5y ago
        Making mistakes is one thing Thinking two steps ahead can be done even when you make mistakes
- istingray 5y ago
  heheh possible! After pages and pages of "I'm confused why people are outraged about this" trolls....I could use a joke like this :)
savant_penguin 5y ago
The real question is: how can they make sure people are not committing other crimes? They better scan all messages at all times. Are they meeting more people face to face than the government permits? The only way to be sure is to log all gps data and compare. They better monitor every aspect of their customers lives to protect the children. Think of the children
- abraae 5y ago
  According to that line of thought, we wouldn't have speed cameras because they can't be used to detect e.g. drunk driving. It's fair IMO to use fit for purpose technology to target specific crimes. Though I agree this is bad technology, not fit for purpose, and they should yank it.
  - alfiedotwtf 5y ago
    No. This is more like Apple enabling telemetry on your iPhone, and if it looks like you're traveling on a road higher than its designated speed, you'll be auto-fined.
  - pjmlp 5y ago
    When in UK I always feel being watched thanks to CCTV warnings everywhere. It is also the only country from all of those I have been in almost 50 years, where great care is taken to never park in an illegal way. Sure you will see it, away from city centers where no cameras are around.
    - short_sells_poo 5y ago
      > It is also the only country from all of those I have been in almost 50 years, where great care is taken to never park in an illegal way. This is only true for the masses. Rich people just leave their cars parked anywhere they want in Mayfair in London because they don't care about a 50 quid fine.
      - zimpenfish 5y ago
testfoobar 5y ago
1) Some dev team at Apple is writing the on device scanning code. 2) Some dev team at Apple is writing a "sendMessagePolice()" API. 3) Some QA team at Apple is testing both systems. I would personally quit if asked to work on any of these teams. If you were the QA team lead for this, how would you test it? I can't imagine anyone would do day-to-day testing with actual illegal images. It would not surprise me if the dev and QA teams at Apple already have hash colliding images to run their tests? This is all awful. Steve Jobs must be rolling over in his grave.
- sumedh 5y ago
  > I can't imagine anyone would do day-to-day testing with actual illegal images. You select any random image as your test image, marking that image as CP in the backend and then try to upload that image from your test phone.
  - testfoobar 5y ago
    Understood that that is how you test in the early stages. But at some point you have to run tests against the actual deployed perceptual hash database.
    - deleted 5y ago
      [deleted]
    - Ambroos 5y ago
      No reason why you can't just generate random images and add them to the real database, indistinguishable from actual hashes. As long as the test images aren't public it's low risk, and even if they leak they could be removed from the database and new test images could be generated.
      - testfoobar 5y ago
        That makes sense. I would still quit the team.
      - 5y ago
somenewaccount1 5y ago
i imagine they are doing this to comply with some law that requires they scan images in iCloud, and they don't want to start storing those un-encrypted. Does anyone know if there is such a law?
- ipv6ipv4 5y ago
  This is the text of the current law in the U.S. [1]. Alerting authorities about CP is required if discovered. Actively searching for CP is not required. Look for the aptly named "protection of privacy" paragraph. [1] https://www.law.cornell.edu/uscode/text/18/2258A https://www.law.cornell.edu/uscode/text/18/2258A
  - nonbirithm 5y ago
    There might not be a law, but in practice, letting criminals host illegal data on your servers is unlikely to be a good look. The intent of the laws making the possession CSAM illegal are ultimately to stop the spread of CSAM. If those laws fail in their stated purpose just because a company chooses not to be proactive in how it searches for the material, that would be missing the point. The media and governmental pressure would wipe any company foolish enough not to implement child safety measures out of existence, but no major tech company is that foolish (except Kik perhaps). And hypothetically, the government could just pass a law enforcing proactive scanning if there were to exist a company that chose not to proactively scan, which would mean that the government would fail to solve the issue of preventing the spread of CSAM, and thus CSA. But in practice, such a law isn't needed. No company wants to be derided as a service that allows child abusers to get away with their crimes.
  - somenewaccount1 5y ago
    (f)Protection of Privacy. —Nothing in this section shall be construed to require a provider to —(1)monitor any user, subscriber, or customer of that provider; (2)monitor the content of any communication of any person described in paragraph (1); or (3)affirmatively search, screen, or scan for facts or circumstances described in sections (a) and (b). Hrm, that's interesting. I wonder if Apple iCloud has surfaced in enough cases as where criminal activity is actively taking place that it prompted Apple to do something about it.
testfoobar 5y ago
Homosexuality is a crime in some countries. Would Apple allow country level filters that call the police in some countries but not others due to local criminal statutes? What about cannabis use?
- pulse7 5y ago
  Apple follows "local laws" because it wants to make business everywhere in the world... Example: Apple in China.
  - dkdbejwi383 5y ago
    This system could potentially look for images that offend the CCP, such as the Hong Kong flag, Uighur iconography, pictures of Winnie the Pooh, etc.
    - zimpenfish 5y ago
      > This system could potentially As could PhotoDNA, though, which everyone has been using for a decade to scan cloud photos - but it doesn't seem to have happened.
      - intricatedetail 5y ago
        There is a difference though. Apple is going to scan your device. It's like having a search without a warrant.
  - boublepop 5y ago
    What is the alternative? Not following local law? Apple is just a company, they cannot and do not make their own laws, this should be obvious and not a point of criticism. If you don’t like the laws as they are written in China, then you shouldn’t be lobbying Apple to ignore or break them, you should be lobbying politicians to change them.
    - deleted 5y ago
BoHerfIIIJrEsq 5y ago
I don't care if Apple actually ends up going through with it. I already decided to de-Apple myself. No more iPhones, no more MacBooks.
sharperguy 5y ago
I find this discussion interesting, because there is no way to prove that Apple does not already do this, since their operating system source code is completely opaque, and the lenghts they go to to prevent you from viewing or modifying it.
- pulse7 5y ago
  Maybe all this is just a PR message to everybody: "Your data is not safe! Don't store anything private on your phone!"
pulse7 5y ago
Imagine this: Apple's software is scanning for abuse images and finds a ton of false positives which are then manually inspected. Those false positives are... >>private photos of naked adult man and woman<<... and this is exactly what you want to hide from >>everybody<< on the planet... but no: they will be manually inspected... Good luck Apple fans! :-)
- arbirk 5y ago
  False positives will be very rare. We probably won't hear of any incidents except for activists trying to spoof the system. CSAM is one of the most extreme crimes against a person and the number of people sharing and profiting from CSAM is growing. This is something every tech company will have to deal with.
  - pulse7 5y ago
    In Germany about 40% of the cases where naked child photos are found are false positives: it is sexting among teenagers...
    - umanwizard 5y ago
      In the US, if I understand correctly, those would be true positives, and everyone who created, received, or distributed them would be guilty of a crime. There’s no exception in the law for pictures you took of yourself.
  - minton 5y ago
    If true, it’s incredible that the numbers are growing. With today’s big data and surveillance (i.e., privacy is dead), I would think it would be impossible for there to be any sizable groups profiting from CSAM.
  - amanaplanacanal 5y ago
    This part I’m unclear on: is anybody actually profiting? And is child abuse actually growing? Or is it just photo sharing that’s growing?
robertwt7 5y ago
Will they ever listen though? This is so wrong in so many levels but not sure if apple ever listen.
tlogan 5y ago
So Apple is not required by law to do this. So why they are doin this?
- EricE 5y ago
  That's the real question. They had to know it would be a contentious issue; what's the real long term goal here?
DanWritesCode 5y ago
One of the things I really didn't expect to be Googling in 2021 is 'Best dumb phone 2021'. After advocating to all my friends that Apple is a beacon of how privacy should be done, I just can't understand how they've made such a hash of this.
- fsflover 5y ago
  Why a dumb phone if you have a verifiable FLOSS GNU/Linux phone in 2021, Librem 5 or Pinephone?
  - LinuxBender 5y ago
    Have any wireless providers verified that Firmware/OS/App updates can't be pushed via OTA to those devices? Asking because to my knowledge no such verification has been attempted. Background: I used to push firmware updates to phones in the 90's on a GSM network. The only reason we didn't do this globally was risk of customer support issues.
    - fsflover 5y ago
      Both phones have their modems separated from the OS with USB/M.2 interfaces. Also, they have kill switches. Pinephone's modem even runs Linux: https://linuxsmartphones.com/hackers-develop-open-source-firmware-for-the-pinephone-modem-use-it-to-make-phone-calls/ https://linuxsmartphones.com/hackers-develop-open-source-fir....
      - LinuxBender 5y ago
        I understand what you are saying, but in my opinion that doesn't really answer the question. For a phone to attach to a network, there is some level of bidirectional trust and those kill-switches aren't going to just arbitrarily activate. Has anyone at a wireless provider tested pushing OTA updates to those phones? Has the vendor explicitly stated that the phones will explicitly block by default any attempts at OTA updates or that the phones explicitly do not have the capability?
nbzso 5y ago
I am glad that Apple has shown the true colors of trillion dollar corporation thinking. I see opportunity for people to understand the biggest problem with a future in which humans are only a datapoint in framework designed to benefit few on expense of many. Can you imagine this "narrative" applied everywhere? From the moment you open your eyes everything around you is extracting data, monitoring and policing you. We have to redefine our relationship with software and hardware (electronics). The infrastructure (5g) and IOT advancements are here. Data is the fuel of the coming "consumer revolution". Apple just positioned themselves perfectly as a Data Broker for high level customers - special groups, oppressive governments, you name it. They will not back up from this. This is more profitable than selling shiny toys and "services". This gives political elites a reason not to break Apple monopolistic business practices. I will go even further: This gives Apple a favorable position to become a trusted partner of governments of the World. Deconstructing this only from a technical point of view is non-efficient. Apple is making an entrance on political stage by embracing the role of World Digital Police. Everyone is free to apply his own conclusions and analysis. Mine are proportionally adequate. I have removed macOS from production workflow. I will never buy another Apple product. And I am willing to throw away "conveniences" and polished UX for preserving my privacy. This privacy, not Apples corporate redefinition: The quality or condition of being secluded from the presence or view of others. The state of being free from public attention or unsanctioned intrusion. A state of being private, or in retirement from the company or from the knowledge or observation of others; seclusion. https://www.youtube.com/watch?v=z15JLtAuwVI https://www.youtube.com/watch?v=z15JLtAuwVI
- pulse7 5y ago
  Why don't Apple customers start a class action for misleading ads? From Apple's ads: "Privacy. That's iPhone."...
  - brandon272 5y ago
    "Privacy is a fundamental human right." https://www.apple.com/privacy/ https://www.apple.com/privacy/
jl2718 5y ago
I understand the issues, but, this headline sounds absolutely awful to the uninitiated. They can never go backward on this.
cassalian 5y ago
There's been a lot of question about the motivation for this feature. Am I the only one that thinks this could be related to things like the EARN IT (or something similar). Here's an article from a year ago on EARN IT: > Theoretically, a system that uses client-side scanning could still send messages encrypted end to end, and so the Leahy amendment would not offer any protection, but many of the same confidentiality concerns with backdoored “e2ee” systems would continue to apply. Source: https://cdt.org/insights/the-new-earn-it-act-still-threatens-encryption-and-child-exploitation-prosecutions/ https://cdt.org/insights/the-new-earn-it-act-still-threatens...
- EricE 5y ago
  Sensitizing people to the idea that a benevolent dictator is going through content on their local device for their benefit. It's all about conditioning. First it's to save the children. Then it will be about preventing the terrorists. Finally it will be about preventing "hate speech" - which these days hate speech is pretty much speech from anyone you disagree with :p Like the 1984 novel, Minority Report wasn't an instruction manual!
kemayo 5y ago
I want to ignore most of this article to complain about an inaccuracy that keeps coming up. > More broadly, they said the change will break end-to-end encryption for iMessage, which Apple has staunchly defended in other contexts. But... it wouldn't. The iMessage feature doesn't expose the contents of your message to anyone else under any circumstance. If you're a child under 13 and your parents have opted in to this feature, you get a choice of seeing naked-pictures sent to you and having your parents be notified that you chose to, and not seeing it with no notifications of anything. (But once you're 13+, no notifications would occur either way.) There are potential issues with this, mostly relating to abusive families being controlling. They'd have to do weird things like forcing their teenaged children to keep making new under-13 accounts to actually take advantage of it like that, though. And none of these issues impact the e2e status of iMessage in any way. Apple really screwed up PR by launching the iMessage feature alongside the scanning-and-reporting iCloud Photos feature. There's so much confusion out there about this. (The breaking-e2e aspect does exist with the iCloud Photos scanning... not that it's currently e2e, of course.)
- TechBro8615 5y ago
  So one part of the proposal breaks e2e encryption for Photos.app, and the other breaks it for Messages.
  - kemayo 5y ago
    How does this break e2e for Messages? They're still only ever decrypted on your device, and their content is never shared with others. You have to radically redefine what "e2e encryption" means for this to qualify as breaking it. There's no e2e encryption for Photos currently, so it can't be breaking it there. If you use iCloud Photos, your photos are stored encrypted, but Apple has the key and could be doing all the cloud-scanning it felt like.
    - TechBro8615 5y ago
      Not sure it needs to exist already to be broken
mtbnut 5y ago
"It's a backdoor. We know we said backdoors are bad and that a backdoor can be used by both good guys and bad guys, but this backdoor is made with Apple-certified lumber."

296 points by arkadiyt 5y ago

Apple did this in such a myopic, I want to say almost comically stupid manner. Craig's interview in and of itself was the biggest indictment of technology companies one could ever hope for. Dude literally stumbles as he says "multi-step algorithm" as if the world is being graced by his bountiful excellence. Can't believe this dude is running software at Apple. The headline for all of this should be "We know what it does and we don't want it"

istingray 5y ago
I'm waiting for betting odds of Apple rolling this back to pop up on polymarket https://polymarket.com/ https://polymarket.com/
hypothesis 5y ago
> "We know what it does and we don't want it" And that interview is likely supposed to telegraph that they “don’t care”. It wasn’t a live one, was it? They could have improved parts of it if they wanted.
SilverRed 5y ago
All of the PR out of Apple seems to assume that people simply do not understand how it works and if they did they would feel better. Everyone understands well enough how it works and understands how trivially it could be changed to search for other kinds of content.
- Animats 5y ago
  Right. At some point, the back story behind this will leak out. That will be interesting. This has to be something Apple was asked/pressured/ordered to do. As a business activity it makes no sense. Bear in mind that over the last week, people in Afghanistan have been frantically trying to erase any evidence of doing things the Taliban doesn't like, such as women playing sports.
  - jjcon 5y ago
    I’m inclined to believe it was a quid-pro-quo (or a play at it). Apple inserts a little back door, in exchange the antitrust case against them will be eased.
    - unityByFreedom 5y ago
      That sounds too corrupt to be believed. If someone came out with evidence of that it would completely blow such a deal.
    - hughrr 5y ago
      Based on the letter by NCMEC describing opponents to the technology as “screeching voices of the minority”, I suspect this is some kind of variant of being guilted into doing something by either lobbying, marketing or internal proponents. This resulted in a tone deaf death march and now they’re trying to work out how to spin it. This is a fairly typical corporate failure mode. Sometimes the best thing is to do nothing as they have found out because now they’re stuck in a position where the two exits are either piss off everyone by writing off their privacy stance or piss off everyone else for canning child porn scanning. What a complete fuck up.
    - michelb 5y ago
      I'm convinced none of these conspiracy theories hold up. This is a typical Apple thing. Thought long and hard about something in a mostly isolated setting and then missing some obvious things.
      - hdjjhhvvhga 5y ago
        You might be right. On the other hand, all their past controversial ideas were reasonable from the financial point of view: introduce non-standard connectors, remove the minijack, make the hardware non-upgradeable and so on. All these things were bad for consumers, but good for Apple's bottom line. This one is bad for everybody. Apple's management is not stupid, they must have a good reason.
  - unityByFreedom 5y ago
- kgwxd 5y ago
  Gaslighting is the term. From the first instance any one/entity uses it, trust should be over, forever, never to be regained.
- ilogik 5y ago
  can someone please explain to me what is this scary scenario where this is being misused? Am I the only one that isn't seeing it?
  - zimpenfish 5y ago
    The scanning matches against CSAM hashes provided by NCMEC - the fear is that NCMEC will be pressured into including hashes of non-CSAM material that USGOV want to track as well (say MAGA images for the current administration.) (One counterpoint to this is that PhotoDNA has been used for scanning cloud images using NCMEC-provided hashes for a decade now and this slippery slope doesn't seem to have happened yet.)
    - ilogik 5y ago
      this is a very weak argument. The MAGA crowd has been posting images all over social media. My understanding is that there is a threshold that needs to be met, and then an Apple employee with a very difficult job will need to confirm the image. So even if NCMEC get pressured, I don't see what the result can be.
      - tjpnz 5y ago
        That Apple employee (assuming the role doesn't get contracted out) has no incentive to protect you or me. But they'll absolutely err on the side of caution to protect their own livelihood.
        ilogik 5y ago
        and what's the next step? FBI breaks down my door because I said something bad about Biden?
        umanwizard 5y ago
        Something like that is unlikely to happen because the US is not — for now — an authoritarian state. Replace “FBI” and “Biden” with their equivalents in various other countries and yes, it’s absolutely plausible.
- varispeed 5y ago
  > Everyone understands well enough how it works and understands how trivially it could be changed to search for other kinds of content. I think it's not really a problem of what is being looked for, but the mere fact that it will be done without a warrant on a personal device.
zepto 5y ago
If you read the letter, if’s clear that whoever wrote it has little understanding of what it does. There are good reasons not to want this. Just not making everyone into a suspect would be a start. But whoever wrote the letter is clueless.
- elisbce 5y ago
  This part is legit though: governments around the world could pressure Apple to add other forms of surveillance. Be it hashes of non-CSAM, or simply pressure NEMEC or other hash providers, or extending its capabilities to all messages or photos on device. In my opinion, this is the biggest concern, not the technology. Before, Apple could simply refuse by saying we don't have the capabilities. But now, that excuse is gone. Apple's promise to human review content and only report CSAM is the weakest link.
  - zepto 5y ago
    > governments around the world could pressure Apple to add other forms of surveillance. What do they have now that they didn’t have before?
  - karlshea 5y ago
    If you read their Security Threat Model Review [1] they're only using the "intersection of hashes provided by at least two child safety organizations operating in separate sovereign jurisdictions". So you'd have to pressure NEMEC and another org under a different government to both add the non-CSAM hash, plus Apple would need to be pressured to verify a non-CSAM derivative image, plus you'd need other hash matches on-device to exceed the threshold before they could even do the review in the first place (they can't even tell if there was a match unless the threshold is exceeded). I get why people are concerned, but between this thread and the other thread yesterday it's clear that pretty much everyone discussing this has no idea how it works. 1: https://www.apple.com/child-safety/pdf/Security_Threat_Model_Review_of_Apple_Child_Safety_Features.pdf https://www.apple.com/child-safety/pdf/Security_Threat_Model...
    - 5y ago
rjzzleep 5y ago
My initial response was that maybe that's why Apples software development has gone down in quality so much in the recent years. But then again he's been leading it since 2009 so maybe not. But it's definitely around the same time that they started removing programmability from the core os. https://www.apple.com/leadership/craig-federighi/ https://www.apple.com/leadership/craig-federighi/
- arthurcolle 5y ago
  I deeply hope that he gets pushed out because of this. The skeuomorphism guy was definitely horrible and obviously was the cause of many assaults upon the senses, but this CSAM spyware scandal was such an affront on all that democratic, enlightened society holds close to the chest. There are so many more talented software development leaders out there (maybe scratch all the ones working on adtech), but he's clearly a cultural troglodyte and this is evidence that he is incapable of actually leading the future engineers and software workers of the world. If I saw him in a social setting I would try to ask him how he lives with himself, actively enabling the potential future dystopia and being incapable of defending the actual impetus of his actions, much less the reaction to it. Truly unforgivable, especially in an age of increased social fragmentation.
  - rjzzleep 5y ago
    > If I saw him in a social setting I would try to ask him how he lives with himself, actively enabling the potential future dystopia and being incapable of defending the actual impetus of his actions, much less the reaction to it. Truly unforgivable, especially in an age of increased social fragmentation. He seems like a guy who genuinely believe that what he's doing is a net positive for society and that society should just leave things in his hands. There are plenty of people like that at google last I remember. I used to go to the google dev day and the was no greater difference between really talented technical people presenting interesting things and engineering leadership believe that everyone should just have a dumb terminal in their hand and that google should do any processing and how that would be so much better for society.
beckman466 5y ago
> Craig's interview in and of itself was the biggest indictment of technology companies one could ever hope for. Dude literally stumbles as he says "multi-step algorithm" Anybody a link?
- arthurcolle 5y ago
  https://www.youtube.com/watch?v=OQUO1DSwYN0&ab_channel=WallStreetJournal https://www.youtube.com/watch?v=OQUO1DSwYN0&ab_channel=WallS... Here you go
- anshumankmr 5y ago
  https://www.wsj.com/video/series/joanna-stern-personal-technology/apples-software-chief-explains-misunderstood-iphone-child-protection-features-exclusive/573D76B3-5ACF-4C87-ACE1-E99CECEFA82C https://www.wsj.com/video/series/joanna-stern-personal-techn...
labster 5y ago
I’m starting to wonder if this is Apple’s strategy all along. They’ve had pressure for years from law enforcement to abuse their monopoly power to invade people's privacy. So they implement it in a relatively naive approach and sell in a hamfisted way, so that everyone turns against them for a little while. Apple backs off, and every time after this they point law enforcement to this debacle. See, we can’t help you, our customers wouldn’t tolerate it! Not sure if it’s true or not, but we shouldn’t assume companies always intend their public plans to succeed. Maybe they actually want a high profile retreat — it could certainly save them development time down the road by not implementing government misfeatures.
- JumpCrisscross 5y ago
  > they actually want a high profile retreat Still incompetent. This would have made sense under another administration. The only thing holding back the antitrust dogs is public opinion. An Apple antitrust case would be politically costly in a way a Facebook case wouldn't. This type of thing corrodes the core of the pro-Apple vocal minority. It's bad GR, if that was the plan.
  - cryptonector 5y ago
    The average joe doesn't care about antitrust.
    - JumpCrisscross 5y ago
      > average joe doesn't care about antitrust Neither do they about privacy.
      - cryptonector 5y ago
        They almost certainly care more about privacy. Enough more? No. But when horror stories start filtering out they'll care more, even if it is too late.
  - arthurcolle 5y ago
scrps 5y ago
The second the world realized those weird nerds no one paid any attention to were gold mines was the beginning of the end. Whatever values we held as hackers, engineers, scientists is now subservient to the monied powers who could never figure any of this out on their own but are exceptionally skilled at convincing or threatening everyone into dancing to the beat of their own self interest. Stop feeding them and they will starve on their ignorance. I'd rather be poor in a better world than rich in a dystopia.
- varispeed 5y ago
  > I'd rather be poor in a better world than rich in a dystopia. The problem is that we all end up being poor in a dystopia. The regulatory capture of industries is an ongoing thing. When 20 years ago you could start your own business in your garage, without substantial capital, today you are dependent on "Angel investors" and bank loans, which is an equivalent of having to be referred into a "club". If you can't find an investor, it will take you a lifetime to save money to start a business, if you are lucky. Take notice that all taxation is being shifted to workers to limit their chances of raising capital and creating competition.
Clubber 5y ago
The "screeching minority" memo gives some insight. Let me break it down line by line. This is just my personal opinion as an external observer; I have no actual insight into what was going on. Team Apple, This is from someone outside the Apple ecosystem that management brought in and gave a lot of credence to. I wanted to share a note of encouragement to say that everyone at NCMEC is SO PROUD of each of you and the incredible decisions you have made in the name of prioritizing child protection. The recipients of this memo didn't make any of the decisions and those were foisted on them by management who in turn were heavily influenced by this person/organization. As to why management was so heavily influenced, I have no idea. This is an attempt to get buy-in from Apple employees I suspect, or at least to ease their concerns. "Don't worry, you are doing the right thing." It’s been invigorating for our entire team to see (and play a small role in) what you unveiled today. The team they are referring to are the ones that pushed for the implementation for child protection. The recipients did all the work because management told them to. I know it’s been a long day and that many of you probably haven’t slept in 24 hours. We know that the days to come will be filled with the screeching voices of the minority. This is the big quote. The author knew what this would do, and knows the tarnish the Apple brand is about to go through, but is trying to convince the audience that it's only a small group of people who will reject this and it will pass over. For the author, the ends justify any means because they are probably personally emotionally traumatized by child porn (rightfully so). Once this happens though, any rationality about consequence of action goes out the window. This is an attempt to get everyone concerned on the same level of ends-justify-the-means with the author. I don't know if the author believes this is just a temporary outrage or not. I suspect not. It doesn't really matter though the author got what they wanted, Apple brand be damned. Our voices will be louder. This obviously isn't the case. Not sure if the author means their organization or their organization + Apple. Either way, the counter resistance to this has been pretty minimal. They left Apple hang out to dry it seems. Our commitment to lift up kids who have lived through the most unimaginable abuse and victimizations will be stronger. During these long days and sleepless nights, I hope you take solace in knowing that because of you many thousands of sexually exploited victimized children will be rescued, and will get a chance at healing and the childhood they deserve. This is the emotional sell, or "for the children." It's also a difficult bridge to reason across; comparing the possession of pictures and the manufacture of pictures as the same thing. Obviously the hash compare only finds existing manufactured pictures, so I don't see how it will protect children from any abuse that hasn't already occurred. Not only is this an emotional sell, it's a lie. Thank you for finding a path forward for child protection while preserving privacy. The final emotional pitch directed at people at Apple typically concerned with privacy. They aren't really protecting children and they also aren't preserving privacy. It's a boondoggle. In closing, "for the children," is almost always a trap. It was used when I was a kid to mass incarcerate Americans that had drug problems, many of them the children they were protecting. It's typically done in an any-means-necessary heavy handed manner, as seen here. I don't condone child pornography in any way. I have never seen child pornography and hope to never see it. At the same time, what they are doing is the road to hell paved with good intentions seemingly by people who are so traumatized (based on their work) that they can't see the collateral damage they are doing.
goldcd 5y ago
I genuinely think it's intentional - Apple want to be stopped. Rather than fighting small battles to defend privacy, just take a hyperbolic extreme and use the backlash to bolster their actual position. (or I geuninely think they have lost their f'in minds)

istingray 5y ago

Here's the link to the open letter from the policy group (PDF): https://cdt.org/wp-content/uploads/2021/08/CDT-Coalition-ltr-to-Apple-19-August-2021.pdf https://cdt.org/wp-content/uploads/2021/08/CDT-Coalition-ltr...

JumpCrisscross 5y ago

Do we know who within Apple is pushing for this?

istingray 5y ago
In the crazy universe where Apple rolls this back, what does it look like? Cook resigns? Craig? Team is sacked?
- PopePompus 5y ago
  Nobody needs to resign. Nobody needs to be sacked. They just need to acknowledge the mistake and not push the spyware update.
  - EGreg 5y ago
    Yeah I still remember Scott Forstall being pushed out over the Apple Maps failures. And that is how Jony Ive came to take over both hardware and software design, leading to the end of skeumorphic design that Jobs loved so much - and made the iPhone so unique. Now Apple’s just a follower…
    - stackbutterflow 5y ago
      >leading to the end of skeumorphic design that Jobs loved so much Jobs loved the end of skeumorphic design or Jobs loved skeumorphic design?
      - dkdbejwi383 5y ago
        Loved it, apparently. https://www.businessinsider.com/steve-jobss-signature-design-style-2014-10 https://www.businessinsider.com/steve-jobss-signature-design...?
    - nebula8804 5y ago
      I heard he was pushed out not due to the failure but that he refused to improve and accept the mistakes that he made. It pissed off Tim Cook who was already mad that he apparently couldn't work with the other team members well. Take all this with a grain of salt. I wonder if Jobs was just good at managing these brash personalities together.

endisneigh 5y ago

Apple will not drop their plans. Google and Facebook are already doing this. Be happy at least Apple’s implementation happens client side and therefore can preserve end to end encryption. https://transparencyreport.google.com/child-sexual-abuse-material/reporting?hl=en https://transparencyreport.google.com/child-sexual-abuse-mat... https://www.facebook.com/safety/onlinechildprotection https://www.facebook.com/safety/onlinechildprotection https://www.microsoft.com/en-us/photodna https://www.microsoft.com/en-us/photodna https://blog.flickr.net/en/2021/04/16/keeping-flickr-and-children-safe/ https://blog.flickr.net/en/2021/04/16/keeping-flickr-and-chi... Most companies dealing with photos have had this in place for almost a decade now. The FUD and slippery slope arguments are getting old.

Bilal_io 5y ago
> Be happy Just because the bar is so low does not mean we have to accept privacy abuse.
- endisneigh 5y ago
  You don’t have to accept it. Don’t use iCloud, no problem.
  - deleted 5y ago
    [deleted]
brendoelfrendo 5y ago
> Be happy at least Apple’s implementation happens client side and therefore can preserve end to end encryption potentially. No, why would I be happy with this? I actually prefer the alternative: scan photos server side, fine. That's Apple's computer and if I send my photos there, then I can't justifiably argue against that. But my device shouldn't be part of their attempt to appease law enforcement by turning the world into a dragnet.
- endisneigh 5y ago
  If you don’t send your photos this doesn’t affect you in any way.

jitl 5y ago

What if this is four-dimensional chess by Apple: maybe they deliberately announced this back door, just to prove how politically poor the backdoor topic is with the public? Maybe Congress will think twice about trying to force this via legislation on anyone. (This comment is intended as a joke.)

vegetablepotpie 5y ago
How could you say that? You have to apply Occam’s razor here, which would say that Apple comically misstepped and nothing more.
- EGreg 5y ago
  Why would you assume companies are more likely to be unable to think two steps ahead?
  - vegetablepotpie 5y ago
    Because companies are lead by people and people make mistakes.
    - EGreg 5y ago
      Making mistakes is one thing Thinking two steps ahead can be done even when you make mistakes
istingray 5y ago
heheh possible! After pages and pages of "I'm confused why people are outraged about this" trolls....I could use a joke like this :)

savant_penguin 5y ago

The real question is: how can they make sure people are not committing other crimes? They better scan all messages at all times. Are they meeting more people face to face than the government permits? The only way to be sure is to log all gps data and compare. They better monitor every aspect of their customers lives to protect the children. Think of the children

abraae 5y ago
According to that line of thought, we wouldn't have speed cameras because they can't be used to detect e.g. drunk driving. It's fair IMO to use fit for purpose technology to target specific crimes. Though I agree this is bad technology, not fit for purpose, and they should yank it.
- alfiedotwtf 5y ago
  No. This is more like Apple enabling telemetry on your iPhone, and if it looks like you're traveling on a road higher than its designated speed, you'll be auto-fined.
- pjmlp 5y ago
  When in UK I always feel being watched thanks to CCTV warnings everywhere. It is also the only country from all of those I have been in almost 50 years, where great care is taken to never park in an illegal way. Sure you will see it, away from city centers where no cameras are around.
  - short_sells_poo 5y ago
    > It is also the only country from all of those I have been in almost 50 years, where great care is taken to never park in an illegal way. This is only true for the masses. Rich people just leave their cars parked anywhere they want in Mayfair in London because they don't care about a 50 quid fine.
    - zimpenfish 5y ago

testfoobar 5y ago

1) Some dev team at Apple is writing the on device scanning code. 2) Some dev team at Apple is writing a "sendMessagePolice()" API. 3) Some QA team at Apple is testing both systems. I would personally quit if asked to work on any of these teams. If you were the QA team lead for this, how would you test it? I can't imagine anyone would do day-to-day testing with actual illegal images. It would not surprise me if the dev and QA teams at Apple already have hash colliding images to run their tests? This is all awful. Steve Jobs must be rolling over in his grave.

sumedh 5y ago
> I can't imagine anyone would do day-to-day testing with actual illegal images. You select any random image as your test image, marking that image as CP in the backend and then try to upload that image from your test phone.
- testfoobar 5y ago
  Understood that that is how you test in the early stages. But at some point you have to run tests against the actual deployed perceptual hash database.
  - deleted 5y ago
    [deleted]
  - Ambroos 5y ago
    No reason why you can't just generate random images and add them to the real database, indistinguishable from actual hashes. As long as the test images aren't public it's low risk, and even if they leak they could be removed from the database and new test images could be generated.
    - testfoobar 5y ago
      That makes sense. I would still quit the team.
    - 5y ago

somenewaccount1 5y ago

i imagine they are doing this to comply with some law that requires they scan images in iCloud, and they don't want to start storing those un-encrypted. Does anyone know if there is such a law?

ipv6ipv4 5y ago
This is the text of the current law in the U.S. [1]. Alerting authorities about CP is required if discovered. Actively searching for CP is not required. Look for the aptly named "protection of privacy" paragraph. [1] https://www.law.cornell.edu/uscode/text/18/2258A https://www.law.cornell.edu/uscode/text/18/2258A
- nonbirithm 5y ago
  There might not be a law, but in practice, letting criminals host illegal data on your servers is unlikely to be a good look. The intent of the laws making the possession CSAM illegal are ultimately to stop the spread of CSAM. If those laws fail in their stated purpose just because a company chooses not to be proactive in how it searches for the material, that would be missing the point. The media and governmental pressure would wipe any company foolish enough not to implement child safety measures out of existence, but no major tech company is that foolish (except Kik perhaps). And hypothetically, the government could just pass a law enforcing proactive scanning if there were to exist a company that chose not to proactively scan, which would mean that the government would fail to solve the issue of preventing the spread of CSAM, and thus CSA. But in practice, such a law isn't needed. No company wants to be derided as a service that allows child abusers to get away with their crimes.
- somenewaccount1 5y ago
  (f)Protection of Privacy. —Nothing in this section shall be construed to require a provider to —(1)monitor any user, subscriber, or customer of that provider; (2)monitor the content of any communication of any person described in paragraph (1); or (3)affirmatively search, screen, or scan for facts or circumstances described in sections (a) and (b). Hrm, that's interesting. I wonder if Apple iCloud has surfaced in enough cases as where criminal activity is actively taking place that it prompted Apple to do something about it.

testfoobar 5y ago

Homosexuality is a crime in some countries. Would Apple allow country level filters that call the police in some countries but not others due to local criminal statutes? What about cannabis use?

pulse7 5y ago
Apple follows "local laws" because it wants to make business everywhere in the world... Example: Apple in China.
- dkdbejwi383 5y ago
  This system could potentially look for images that offend the CCP, such as the Hong Kong flag, Uighur iconography, pictures of Winnie the Pooh, etc.
  - zimpenfish 5y ago
    > This system could potentially As could PhotoDNA, though, which everyone has been using for a decade to scan cloud photos - but it doesn't seem to have happened.
    - intricatedetail 5y ago
      There is a difference though. Apple is going to scan your device. It's like having a search without a warrant.
- boublepop 5y ago
  What is the alternative? Not following local law? Apple is just a company, they cannot and do not make their own laws, this should be obvious and not a point of criticism. If you don’t like the laws as they are written in China, then you shouldn’t be lobbying Apple to ignore or break them, you should be lobbying politicians to change them.
  - deleted 5y ago

BoHerfIIIJrEsq 5y ago

I don't care if Apple actually ends up going through with it. I already decided to de-Apple myself. No more iPhones, no more MacBooks.

sharperguy 5y ago

I find this discussion interesting, because there is no way to prove that Apple does not already do this, since their operating system source code is completely opaque, and the lenghts they go to to prevent you from viewing or modifying it.

pulse7 5y ago
Maybe all this is just a PR message to everybody: "Your data is not safe! Don't store anything private on your phone!"

pulse7 5y ago

Imagine this: Apple's software is scanning for abuse images and finds a ton of false positives which are then manually inspected. Those false positives are... >>private photos of naked adult man and woman<<... and this is exactly what you want to hide from >>everybody<< on the planet... but no: they will be manually inspected... Good luck Apple fans! :-)

arbirk 5y ago
False positives will be very rare. We probably won't hear of any incidents except for activists trying to spoof the system. CSAM is one of the most extreme crimes against a person and the number of people sharing and profiting from CSAM is growing. This is something every tech company will have to deal with.
- pulse7 5y ago
  In Germany about 40% of the cases where naked child photos are found are false positives: it is sexting among teenagers...
  - umanwizard 5y ago
    In the US, if I understand correctly, those would be true positives, and everyone who created, received, or distributed them would be guilty of a crime. There’s no exception in the law for pictures you took of yourself.
- minton 5y ago
  If true, it’s incredible that the numbers are growing. With today’s big data and surveillance (i.e., privacy is dead), I would think it would be impossible for there to be any sizable groups profiting from CSAM.
- amanaplanacanal 5y ago
  This part I’m unclear on: is anybody actually profiting? And is child abuse actually growing? Or is it just photo sharing that’s growing?

robertwt7 5y ago

Will they ever listen though? This is so wrong in so many levels but not sure if apple ever listen.

tlogan 5y ago

So Apple is not required by law to do this. So why they are doin this?

EricE 5y ago
That's the real question. They had to know it would be a contentious issue; what's the real long term goal here?

DanWritesCode 5y ago

One of the things I really didn't expect to be Googling in 2021 is 'Best dumb phone 2021'. After advocating to all my friends that Apple is a beacon of how privacy should be done, I just can't understand how they've made such a hash of this.

fsflover 5y ago
Why a dumb phone if you have a verifiable FLOSS GNU/Linux phone in 2021, Librem 5 or Pinephone?
- LinuxBender 5y ago
  Have any wireless providers verified that Firmware/OS/App updates can't be pushed via OTA to those devices? Asking because to my knowledge no such verification has been attempted. Background: I used to push firmware updates to phones in the 90's on a GSM network. The only reason we didn't do this globally was risk of customer support issues.
  - fsflover 5y ago
    Both phones have their modems separated from the OS with USB/M.2 interfaces. Also, they have kill switches. Pinephone's modem even runs Linux: https://linuxsmartphones.com/hackers-develop-open-source-firmware-for-the-pinephone-modem-use-it-to-make-phone-calls/ https://linuxsmartphones.com/hackers-develop-open-source-fir....
    - LinuxBender 5y ago
      I understand what you are saying, but in my opinion that doesn't really answer the question. For a phone to attach to a network, there is some level of bidirectional trust and those kill-switches aren't going to just arbitrarily activate. Has anyone at a wireless provider tested pushing OTA updates to those phones? Has the vendor explicitly stated that the phones will explicitly block by default any attempts at OTA updates or that the phones explicitly do not have the capability?

nbzso 5y ago

I am glad that Apple has shown the true colors of trillion dollar corporation thinking. I see opportunity for people to understand the biggest problem with a future in which humans are only a datapoint in framework designed to benefit few on expense of many. Can you imagine this "narrative" applied everywhere? From the moment you open your eyes everything around you is extracting data, monitoring and policing you. We have to redefine our relationship with software and hardware (electronics). The infrastructure (5g) and IOT advancements are here. Data is the fuel of the coming "consumer revolution". Apple just positioned themselves perfectly as a Data Broker for high level customers - special groups, oppressive governments, you name it. They will not back up from this. This is more profitable than selling shiny toys and "services". This gives political elites a reason not to break Apple monopolistic business practices. I will go even further: This gives Apple a favorable position to become a trusted partner of governments of the World. Deconstructing this only from a technical point of view is non-efficient. Apple is making an entrance on political stage by embracing the role of World Digital Police. Everyone is free to apply his own conclusions and analysis. Mine are proportionally adequate. I have removed macOS from production workflow. I will never buy another Apple product. And I am willing to throw away "conveniences" and polished UX for preserving my privacy. This privacy, not Apples corporate redefinition: The quality or condition of being secluded from the presence or view of others. The state of being free from public attention or unsanctioned intrusion. A state of being private, or in retirement from the company or from the knowledge or observation of others; seclusion. https://www.youtube.com/watch?v=z15JLtAuwVI https://www.youtube.com/watch?v=z15JLtAuwVI

pulse7 5y ago
Why don't Apple customers start a class action for misleading ads? From Apple's ads: "Privacy. That's iPhone."...
- brandon272 5y ago
  "Privacy is a fundamental human right." https://www.apple.com/privacy/ https://www.apple.com/privacy/

jl2718 5y ago

I understand the issues, but, this headline sounds absolutely awful to the uninitiated. They can never go backward on this.

cassalian 5y ago

There's been a lot of question about the motivation for this feature. Am I the only one that thinks this could be related to things like the EARN IT (or something similar). Here's an article from a year ago on EARN IT: > Theoretically, a system that uses client-side scanning could still send messages encrypted end to end, and so the Leahy amendment would not offer any protection, but many of the same confidentiality concerns with backdoored “e2ee” systems would continue to apply. Source: https://cdt.org/insights/the-new-earn-it-act-still-threatens-encryption-and-child-exploitation-prosecutions/ https://cdt.org/insights/the-new-earn-it-act-still-threatens...

EricE 5y ago
Sensitizing people to the idea that a benevolent dictator is going through content on their local device for their benefit. It's all about conditioning. First it's to save the children. Then it will be about preventing the terrorists. Finally it will be about preventing "hate speech" - which these days hate speech is pretty much speech from anyone you disagree with :p Like the 1984 novel, Minority Report wasn't an instruction manual!

kemayo 5y ago

I want to ignore most of this article to complain about an inaccuracy that keeps coming up. > More broadly, they said the change will break end-to-end encryption for iMessage, which Apple has staunchly defended in other contexts. But... it wouldn't. The iMessage feature doesn't expose the contents of your message to anyone else under any circumstance. If you're a child under 13 and your parents have opted in to this feature, you get a choice of seeing naked-pictures sent to you and having your parents be notified that you chose to, and not seeing it with no notifications of anything. (But once you're 13+, no notifications would occur either way.) There are potential issues with this, mostly relating to abusive families being controlling. They'd have to do weird things like forcing their teenaged children to keep making new under-13 accounts to actually take advantage of it like that, though. And none of these issues impact the e2e status of iMessage in any way. Apple really screwed up PR by launching the iMessage feature alongside the scanning-and-reporting iCloud Photos feature. There's so much confusion out there about this. (The breaking-e2e aspect does exist with the iCloud Photos scanning... not that it's currently e2e, of course.)

TechBro8615 5y ago
So one part of the proposal breaks e2e encryption for Photos.app, and the other breaks it for Messages.
- kemayo 5y ago
  How does this break e2e for Messages? They're still only ever decrypted on your device, and their content is never shared with others. You have to radically redefine what "e2e encryption" means for this to qualify as breaking it. There's no e2e encryption for Photos currently, so it can't be breaking it there. If you use iCloud Photos, your photos are stored encrypted, but Apple has the key and could be doing all the cloud-scanning it felt like.
  - TechBro8615 5y ago
    Not sure it needs to exist already to be broken

mtbnut 5y ago

"It's a backdoor. We know we said backdoors are bad and that a backdoor can be used by both good guys and bad guys, but this backdoor is made with Apple-certified lumber."