2 ms·

There is no requirement to scan, only report when found. There is NO end to end encryption being rolled out at the same time (so they can still decrypt and han

There is no requirement to scan, only report when found. There is NO end to end encryption being rolled out at the same time (so they can still decrypt and hand over your data in the cloud). > This means they couldn't comply with a nation states demand to secretly decrypt your data, even if they were legally compelled too, unless they change how the cryptography at play here works. Not only is this completely wrong (they can hand over your decrypted cloud data right now), it's wrong even going forwards with the assumption you made above about real E2EE (which we don't have...) - All they have to do is add a few hashes from that nation state to their catalog and your data is whisked away to apple for them to do with as they please (which right now is meaningless, since they currently have access to it anyways, but makes your point about E2EE a lot less compelling).

jackpeterfletch 5y ago
I didn't realise that theres no requirement to scan. So I'll yield on that. But its still possible that Apple are preparing for a scenario where it does become a requirement in the future. As for the E2EE part, I can't imagine that this wouldn't be launched with E2EE alongside, otherwise theres literally no point whatsoever, they could have just done the scan on iCloud. As for why this combats 'your data being whisked away', check the technical documentation. What they're doing with Private Set Intersection and Threshold Secret Sharing are clear steps to make this system unexploitable, anonymous, and so that it doesn't leak any metadata whatsoever. https://www.apple.com/child-safety/pdf/CSAM_Detection_Technical_Summary.pdf https://www.apple.com/child-safety/pdf/CSAM_Detection_Techni...