3 ms·

> Once the CSAM hash scanning for photos is built into Apple products, the company will face enormous pressure, and possibly legal requirements, from government

by jamil7 5y ago

> Once the CSAM hash scanning for photos is built into Apple products, the company will face enormous pressure, and possibly legal requirements, from governments around the world to scan for all sorts of images that the governments find objectionable. At the risk of sounding cynical, isn't the cat kind of out of the bag on this tech now? Even if they hypothetically rolled this feature back (they won't) all the parties who would love to see it implemented now know that it's possible and can strong-arm Apple or any other vendor into doing it.

Drakim 5y ago
A valid concern, but I'm not sure the cat is out of the bag completely. There are different degrees of everything, and simply pushing for a new set of image hashes to be added to the database is a lot smaller in scope compared to pushing for a feature to be rolled out to all phones.
tpush 5y ago
Nothing in this system makes scanning photos on Govt request any easier, though. That is to say, it is exactly as straightforward as an (authoritarian) Govt to demand and for Apple to implement specific photo scanning & reporting functionality. Anything particularly new in this system is the privacy-preserving part with safety vouchers and stuff; none of that would be relevant if Apple were to be strong-armed by a Govt to do scanning of whatever photos. I get the fear of Govts demanding on-device scanning of private photos, however I fail to see how any of this CSAM stuff makes that scenario more or less likely. The same slippery slope applies already since everybody with an iPhone is executing arbitrary code from Apple all day, every day.
- varispeed 5y ago
  As I understand, government can't force a company to implement on device content scanning. However, once company creates such functionality voluntarily, they can make company to scan all sorts of things and lie about it. This is where Apple is crossing the line.
  - undecisive 5y ago
    I guess it depends on the government. Many have some kind of "you can't operate here unless you meet certain criteria" rules that require implementing special software. Usually those rules center around copyright (e.g. must allow moderator deletion to respond to DCMA requests) or safeguarding or other kinds of government-mandated moderation. But it is certainly possible for any government to force any company to develop any software as a price of doing business in that country. So yes, now that the technology exists and they have proven that it can be integrated with their system, the damage is kinda done. Of course, if Apple now has to publish a different version of their software for, say, the Afghanistan market than they do the surrounding areas, that's a big red flag to people in Afghanistan that Apple have done something shady, likely at the behest of the current Afghan rulers. If that spyware is distributed on every iphone globally, and it's merely picking up on geolocation or some kind of network indicator, there is no smoking gun - so the first time people will know that this has been tuned immorally is when people start disappearing. That's why a lot of the battle should probably now be "Make this software illegal in your country", because then the countries distributing "custom" versions are likely to be infected with this spying capability.
  - Arthur8 5y ago
    Interesting phrasing. You could say that they implemented a process that has a exploitable judicial bug and one would like to avoid exploitable processes. The question for the future is, what is needed to have a process (Software, Laws, Norms,..) for minimising CSAM as much as realistically possible (with net positiv effect for society) but without being exploitable. As the current processes seem not to be adequate.
    - varispeed 5y ago
      > what is needed to have a process The thing is, once there is a capability to search customer device without a warrant, why would you want to limit it only to CSAM? For example, this would be a great way to catch drug users, dealers (someone taking photo of using or their stash / stock), illegal weapon holders, tax evaders (someone posing with wads of cash while being poor on paper) and so on. Then you have countries with strong anti LGBT laws and they would certainly want to prosecute these groups. It's madness.
lrvick 5y ago
Apple can literally execute any code they want on any of the devices users are licensing from them. Those that exchange money for Apple devices are under the very mistaken impression that they own them or have any reasonable expectation of privacy on them.
- pulse7 5y ago
  Why don't Apple customers start a class action for misleading ads? From Apple's ads: "Privacy. That's iPhone."...
  - jqpabc123 5y ago
    The ads are sorta true --- within the context and confines of the vendor/sucker relationship and terms of service agreement. But once you do anything that Apple does not approve of, they'll cut you off, lock your phone and your data and throw you to the wolves. Oh, and by the way, they have full access and will be watching and checking everything you do with your device.

by jamil7 5y ago

Drakim 5y ago

A valid concern, but I'm not sure the cat is out of the bag completely. There are different degrees of everything, and simply pushing for a new set of image hashes to be added to the database is a lot smaller in scope compared to pushing for a feature to be rolled out to all phones.

tpush 5y ago

Nothing in this system makes scanning photos on Govt request any easier, though. That is to say, it is exactly as straightforward as an (authoritarian) Govt to demand and for Apple to implement specific photo scanning & reporting functionality. Anything particularly new in this system is the privacy-preserving part with safety vouchers and stuff; none of that would be relevant if Apple were to be strong-armed by a Govt to do scanning of whatever photos. I get the fear of Govts demanding on-device scanning of private photos, however I fail to see how any of this CSAM stuff makes that scenario more or less likely. The same slippery slope applies already since everybody with an iPhone is executing arbitrary code from Apple all day, every day.

varispeed 5y ago
As I understand, government can't force a company to implement on device content scanning. However, once company creates such functionality voluntarily, they can make company to scan all sorts of things and lie about it. This is where Apple is crossing the line.
- undecisive 5y ago
  I guess it depends on the government. Many have some kind of "you can't operate here unless you meet certain criteria" rules that require implementing special software. Usually those rules center around copyright (e.g. must allow moderator deletion to respond to DCMA requests) or safeguarding or other kinds of government-mandated moderation. But it is certainly possible for any government to force any company to develop any software as a price of doing business in that country. So yes, now that the technology exists and they have proven that it can be integrated with their system, the damage is kinda done. Of course, if Apple now has to publish a different version of their software for, say, the Afghanistan market than they do the surrounding areas, that's a big red flag to people in Afghanistan that Apple have done something shady, likely at the behest of the current Afghan rulers. If that spyware is distributed on every iphone globally, and it's merely picking up on geolocation or some kind of network indicator, there is no smoking gun - so the first time people will know that this has been tuned immorally is when people start disappearing. That's why a lot of the battle should probably now be "Make this software illegal in your country", because then the countries distributing "custom" versions are likely to be infected with this spying capability.
- Arthur8 5y ago
  Interesting phrasing. You could say that they implemented a process that has a exploitable judicial bug and one would like to avoid exploitable processes. The question for the future is, what is needed to have a process (Software, Laws, Norms,..) for minimising CSAM as much as realistically possible (with net positiv effect for society) but without being exploitable. As the current processes seem not to be adequate.
  - varispeed 5y ago
    > what is needed to have a process The thing is, once there is a capability to search customer device without a warrant, why would you want to limit it only to CSAM? For example, this would be a great way to catch drug users, dealers (someone taking photo of using or their stash / stock), illegal weapon holders, tax evaders (someone posing with wads of cash while being poor on paper) and so on. Then you have countries with strong anti LGBT laws and they would certainly want to prosecute these groups. It's madness.

lrvick 5y ago

Apple can literally execute any code they want on any of the devices users are licensing from them. Those that exchange money for Apple devices are under the very mistaken impression that they own them or have any reasonable expectation of privacy on them.

pulse7 5y ago
Why don't Apple customers start a class action for misleading ads? From Apple's ads: "Privacy. That's iPhone."...
- jqpabc123 5y ago
  The ads are sorta true --- within the context and confines of the vendor/sucker relationship and terms of service agreement. But once you do anything that Apple does not approve of, they'll cut you off, lock your phone and your data and throw you to the wolves. Oh, and by the way, they have full access and will be watching and checking everything you do with your device.