4 ms·

It's worth looking into the privacy concerns that Apple was actually trying to fix here: 1. Photos (and other documents) are currently uploaded to iCloud un-en

by phire 5y ago

It's worth looking into the privacy concerns that Apple was actually trying to fix here: 1. Photos (and other documents) are currently uploaded to iCloud un-encrypted 2. These photos are already scanned for CSAM after upload 3. Because the photos are not encrypted, at any point, any government can file a court order to release those photos. 4. The court order can require Apply to not notify the user, or the public in general. 5. [Speculation] Such orders might already exist and be somewhat common within Apple Apple wanted to fix this and introduce end-to-end encryption on all photos uploaded to iCloud, but scanning for CSAM was non-negotiable (due to internal or external politics?). They must keep doing it. So they implemented this big mess of a workaround to scan for CSAM before upload and attach a cert with a decryption key only to photos that match so that they could later human verify once a user had enough matches and weed out false positives (which Apple acknowledge will happen) before notifying law enforcement. Because of the direction that Apple came from, and how much effort they put into designing this system to maximize privacy, they saw this solution as a large privacy win over the existing situation. It's not surprising Apple might have been blinded to the privacy concerns of doing AI scanning of photos on user devices, they were looking at it from the wrong angle.

Unklejoe 5y ago
> Apple wanted to fix this and introduce end-to-end encryption on all photos uploaded to iCloud Apple has not come out and said this. This may be what people hope is the motivation, but I would think they would be immediately coming out to say this if it were the case, as it could be used as ammunition against some of the criticism they've been getting recently.
- phire 5y ago
  True. But I'll point out their technical summary[1] explictly talks about attaching decryption keys to positive matches, which you don't need to do if there is no end-to-end encryption. [1] https://www.apple.com/child-safety/pdf/CSAM_Detection_Technical_Summary.pdf https://www.apple.com/child-safety/pdf/CSAM_Detection_Techni...
deleted 5y ago
[deleted]
hu3 5y ago
Was there a recent announced that Apple will implement e2e encryption or is that speculation?
- phire 5y ago
  We know they were working on it several years ago, but abandoned efforts over two years ago due to FBI push objections[1] Maybe they have restarted those efforts, but with some modifications (like this?). It's hard to tell since Apple is a very secretive company, but the exact design of this system does strongly suggest end-to-end encryption of photos. (Why attach a decryption key to positive matches if the photo isn't encrypted?) I guess it's also possible this was a project kicked of years ago before they abandoned the idea of end-to-end backups and it lived on as a zombie. BTW, while I see Apple's PoV here, I don't think I agree with it. I think I'd rather they stick with the status quo. I'm curious what other people prefer: un-encrypted and subpoenable iCloud photos, or on-device CSAM scanning? [1] https://www.reuters.com/article/us-apple-fbi-icloud-exclusive-idUSKBN1ZK1CT https://www.reuters.com/article/us-apple-fbi-icloud-exclusiv...
  - kemayo 5y ago
    I have a preference for the on-device scanning + e2e Photos. The overall security seems higher, assuming Apple's claims about photos only being scanned during the upload process are true. (If I don't trust Apple to be telling the truth about that, it's not like I could trust them to not already be scanning all my photos, so...)
tpush 5y ago
> 1. Photos (and other documents) are currently uploaded to iCloud un-encrypted No, they are encrypted, just not e2e. Apple holds the encryption key, though. > 2. These photos are already scanned for CSAM after upload No, they are not. > 3. Because the photos are not encrypted, at any point, any government can file a court order to release those photos. Not because they are unencrypted, but because Apple can decrypt them on demand, since they gold the key(s).
willseth 5y ago
> 1. Photos (and other documents) are currently uploaded to iCloud un-encrypted Incorrect. Photos and documents are encrypted both in transit and at rest. They are not E2EE, however - i.e. Apple has decryption keys. > 2. These photos are already scanned for CSAM after upload Apple does no scanning in iCloud. All of your data (except email) is stored encrypted and it cannot be scanned. Apple escrows the decryption keys, which are provided only to comply with legal requests for user data. > 3. Because the photos are not encrypted, at any point, any government can file a court order to release those photos. The second part is true, but the first is not. > 4. The court order can require Apply to not notify the user, or the public in general. This is simply the law. If there is no non-disclosure order, it's Apple's policy to notify. iCloud encryption docs: https://support.apple.com/en-us/HT202303 https://support.apple.com/en-us/HT202303 Legal process docs: https://www.apple.com/legal/privacy/law-enforcement-guidelines-us.pdf https://www.apple.com/legal/privacy/law-enforcement-guidelin...
- phire 5y ago
  Encryption during transit and rest really don't count as encryption, at least not in this context. Apple can decrypt them time to do things like scan them for CSAM. I assumed I wouldn't need to state the obvious. And yes, Apple have been scanning uploaded photos since about 2019. At least, that's when they modified their terms and conditions to allow it. https://www.macobserver.com/analysis/apple-scans-uploaded-content/ https://www.macobserver.com/analysis/apple-scans-uploaded-co...
  - willseth 5y ago
    The author of that article was way off. First, his evidence is that an email attachment triggered a report, and we already know email is the only data stored unencrypted in iCloud. Email scanning is the most plausible explanation for the ToS update he is reading like chicken entrails. If Apple were scanning iCloud Photos, one would expect there to be hundreds of thousands if not millions of reports to NCMEC (last year Facebook reported 20 million). Reporting is compulsory, the information is public, and Apple reported 265 last year. Do the math. Apple is not scanning Photos.

by phire 5y ago

Unklejoe 5y ago

> Apple wanted to fix this and introduce end-to-end encryption on all photos uploaded to iCloud Apple has not come out and said this. This may be what people hope is the motivation, but I would think they would be immediately coming out to say this if it were the case, as it could be used as ammunition against some of the criticism they've been getting recently.

phire 5y ago
True. But I'll point out their technical summary[1] explictly talks about attaching decryption keys to positive matches, which you don't need to do if there is no end-to-end encryption. [1] https://www.apple.com/child-safety/pdf/CSAM_Detection_Technical_Summary.pdf https://www.apple.com/child-safety/pdf/CSAM_Detection_Techni...

deleted 5y ago

[deleted]

hu3 5y ago

Was there a recent announced that Apple will implement e2e encryption or is that speculation?

phire 5y ago
We know they were working on it several years ago, but abandoned efforts over two years ago due to FBI push objections[1] Maybe they have restarted those efforts, but with some modifications (like this?). It's hard to tell since Apple is a very secretive company, but the exact design of this system does strongly suggest end-to-end encryption of photos. (Why attach a decryption key to positive matches if the photo isn't encrypted?) I guess it's also possible this was a project kicked of years ago before they abandoned the idea of end-to-end backups and it lived on as a zombie. BTW, while I see Apple's PoV here, I don't think I agree with it. I think I'd rather they stick with the status quo. I'm curious what other people prefer: un-encrypted and subpoenable iCloud photos, or on-device CSAM scanning? [1] https://www.reuters.com/article/us-apple-fbi-icloud-exclusive-idUSKBN1ZK1CT https://www.reuters.com/article/us-apple-fbi-icloud-exclusiv...
- kemayo 5y ago
  I have a preference for the on-device scanning + e2e Photos. The overall security seems higher, assuming Apple's claims about photos only being scanned during the upload process are true. (If I don't trust Apple to be telling the truth about that, it's not like I could trust them to not already be scanning all my photos, so...)

tpush 5y ago

> 1. Photos (and other documents) are currently uploaded to iCloud un-encrypted No, they are encrypted, just not e2e. Apple holds the encryption key, though. > 2. These photos are already scanned for CSAM after upload No, they are not. > 3. Because the photos are not encrypted, at any point, any government can file a court order to release those photos. Not because they are unencrypted, but because Apple can decrypt them on demand, since they gold the key(s).

willseth 5y ago

> 1. Photos (and other documents) are currently uploaded to iCloud un-encrypted Incorrect. Photos and documents are encrypted both in transit and at rest. They are not E2EE, however - i.e. Apple has decryption keys. > 2. These photos are already scanned for CSAM after upload Apple does no scanning in iCloud. All of your data (except email) is stored encrypted and it cannot be scanned. Apple escrows the decryption keys, which are provided only to comply with legal requests for user data. > 3. Because the photos are not encrypted, at any point, any government can file a court order to release those photos. The second part is true, but the first is not. > 4. The court order can require Apply to not notify the user, or the public in general. This is simply the law. If there is no non-disclosure order, it's Apple's policy to notify. iCloud encryption docs: https://support.apple.com/en-us/HT202303 https://support.apple.com/en-us/HT202303 Legal process docs: https://www.apple.com/legal/privacy/law-enforcement-guidelines-us.pdf https://www.apple.com/legal/privacy/law-enforcement-guidelin...

phire 5y ago
Encryption during transit and rest really don't count as encryption, at least not in this context. Apple can decrypt them time to do things like scan them for CSAM. I assumed I wouldn't need to state the obvious. And yes, Apple have been scanning uploaded photos since about 2019. At least, that's when they modified their terms and conditions to allow it. https://www.macobserver.com/analysis/apple-scans-uploaded-content/ https://www.macobserver.com/analysis/apple-scans-uploaded-co...
- willseth 5y ago
  The author of that article was way off. First, his evidence is that an email attachment triggered a report, and we already know email is the only data stored unencrypted in iCloud. Email scanning is the most plausible explanation for the ToS update he is reading like chicken entrails. If Apple were scanning iCloud Photos, one would expect there to be hundreds of thousands if not millions of reports to NCMEC (last year Facebook reported 20 million). Reporting is compulsory, the information is public, and Apple reported 265 last year. Do the math. Apple is not scanning Photos.