5 ms·

There is an interesting constitutional quirk which arises from the scanning being done client side, specifically for US citizens. If the US Government forced Ap

There is an interesting constitutional quirk which arises from the scanning being done client side, specifically for US citizens. If the US Government forced Apple to add other entries to the hash table, this would constitute a warrantless Government search of the private physical property of US citizens. This is a clear-cut, unambiguous breach of the 4th Amendment. Whereas if the CSAM scanning was performed exclusively in the cloud, protection under the 4th Amendment does not exist as it would likely fall under the third party doctrine. Now I'm not saying the US Government would let mere unconstitutionality get in the way of any surveillance program. But Apple would. You don't think Apple wouldn't be itching for another opportunity to flex in public? Especially now, with their reputation on the line? Apple would love nothing more than to have more opportunities like they got with the San Bernardino iPhone.

rangerdan 5y ago
> If the US Government forced Apple to add other entries to the hash table, this would constitute a warrantless Government search of the private physical property of US citizens. This is a clear-cut, unambiguous breach of the 4th Amendment. There's no reason not to assume this isn't already happening, being closed source and proprietary. The question to ask is, what are we going to do about it?
- simondotau 5y ago
  If you take that line of argument, you must also accept that you have no reason not to assume that binary distributions of Android and Windows haven't been doing similar things for the past decade.
  - shawnz 5y ago
    I agree with you in that I don't think the problem is the closed-source aspect. Closed source software can still be audited (with difficulty). The problem is that the source material for the hashes can't be audited, even when we know exactly how the system works.
  - rangerdan 5y ago
    The audience here should know that where there is capability, there is abuse. Android and Windows are no exception.
jdavis703 5y ago
What kind of non-CSAM crime could be detected with just a couple of hashes? Wouldn’t Apple need to reduce the similarity score in order to even get something close?
rz2k 5y ago
I think you're implying that scanning of private personal property by a corporation without a warrant protects users from searches of their content in the cloud that is authorized by a warrant or national security letter. I don't understand the mechanism if there isn't end to end encryption, and I don't understand the mechanism if there is end to end encryption. Scanning makes phones a greater threat, and also erodes the expectation of privacy that is a legal barrier to surveillance.
- simondotau 5y ago
  I did not intentionally imply anything here, so if anything I wrote appears to include an implied component, that was not intended and may not represent my opinion. All I'm saying is that the implementation Apple has described would be constitutionally blocked from being co-opted by US law enforcement. Obviously if there's no end-to-end encryption, any cloud operator could still be coerced into searching for material server side, as that falls under the so-called third party doctrine.
wyager 5y ago
This is already a warrantless search that’s effectively controlled by the government. Obviously there’s enough chaff in the air to prevent that from being legally useful in any way.
- zepto 5y ago
  Nope. It’s not controlled by the government, and it’s not warrantless, since it is opt-in.
  - Enginerrrd 5y ago
    Since the govt. supplies the hashes in an unauditable way, it absolutely is controlled by the government. What's to stop them from using hashes of non CSAM material?
    - zepto 5y ago
      The government doesn’t supply the hashes in an unauditable way, that is a totally false statement. The hashes are supplied by NCMEC, a non-profit which is auditable, not a secret government agency. In any case, even if a non-CSAM hash were somehow in the database, Apple reviews the images before making reports, and those reports are used in normal criminal prosecutions.
      - nullc 5y ago
        Courts have determined that for this purpose the NCMEC is an agent of the government. NEMEC is 99% funded by the government and its ability to handle child porn is directly deprived from a explicit legislative carveout for them by name. What they do would be a felony for you or I to do. The fact that they are technically non-profit rather than an agency makes them significantly less accountable to the public. We cannot FOIA their communications, their composition isn't subject to public review, we cannot vote them out. And we have no way to tell what their database contains, nor is there any avenue for redress should we somehow learn of an inappropriate listing. To the extent that you can say that they're not exactly a government agency, they absolutely have been deputized by the government.
jrockway 5y ago
Apple could also encrypt every upload to iCloud, and not have any scanning on the client, and still be able to say to the government "sure, you can have the files; we can't read them and neither can you". Apple wants to reduce your privacy from the government above and beyond what the law requires. The questions is: why?
- colejohnson66 5y ago
  The simple answer is: password resets. I’m sure majority of people would be very upset if they lost everything by forgetting a password.
  - nullc 5y ago
    Doesn't the apple backup stuff work that way? The data is gone forever if you lose your password?
    - simondotau 5y ago
      Some, but not all. And if you still have access to a Mac or iOS device which remains associated to this iCloud account, the amount that is lost can be even less.
- roody15 5y ago
  The answer may be related to Pegasus software. Timeline: 1. Leaked documents show Pegasus software exploits all iphones using an exploit in iMessage 2. Apple releases security update (doesn’t patch imessage. exploit) 3. Apple announces CSAM client scanning coming soon 4. Apple releases another security update (still leaves iMessage exploit unpatched and used by Pegasus) …. Perhaps Apple is under pressure to provide a back door prior to patching a tool that may be widely used by governments around the world.
- alisonkisk 5y ago
  Because Apple doesn't want to be a child porn storage service. This is not a secret.
ok123456 5y ago
Also Fifth Amendment. People are being compelled to testify against themselves by running this CSAM scanner. Apple's end-to-end encryption was sold to users as exactly that. To all of a sudden introduce this scanner doesn't negate the expectation of privacy as that is how it was sold and marketed. There is an implied warranty of merchantability of how this service functions.
alisonkisk 5y ago
Are you a lawyer or legal scholar, or just guessing? The government can't compel warrantless searches of Apple. 3rd party doctrine means Apple can search your iCloud, and can give it away if they choose. Same as how Apple can search your phone if you run their software, and can give away whatever they find if they choose.

rangerdan 5y ago

> If the US Government forced Apple to add other entries to the hash table, this would constitute a warrantless Government search of the private physical property of US citizens. This is a clear-cut, unambiguous breach of the 4th Amendment. There's no reason not to assume this isn't already happening, being closed source and proprietary. The question to ask is, what are we going to do about it?

simondotau 5y ago
If you take that line of argument, you must also accept that you have no reason not to assume that binary distributions of Android and Windows haven't been doing similar things for the past decade.
- shawnz 5y ago
  I agree with you in that I don't think the problem is the closed-source aspect. Closed source software can still be audited (with difficulty). The problem is that the source material for the hashes can't be audited, even when we know exactly how the system works.
- rangerdan 5y ago
  The audience here should know that where there is capability, there is abuse. Android and Windows are no exception.

jdavis703 5y ago

What kind of non-CSAM crime could be detected with just a couple of hashes? Wouldn’t Apple need to reduce the similarity score in order to even get something close?

rz2k 5y ago

I think you're implying that scanning of private personal property by a corporation without a warrant protects users from searches of their content in the cloud that is authorized by a warrant or national security letter. I don't understand the mechanism if there isn't end to end encryption, and I don't understand the mechanism if there is end to end encryption. Scanning makes phones a greater threat, and also erodes the expectation of privacy that is a legal barrier to surveillance.

simondotau 5y ago
I did not intentionally imply anything here, so if anything I wrote appears to include an implied component, that was not intended and may not represent my opinion. All I'm saying is that the implementation Apple has described would be constitutionally blocked from being co-opted by US law enforcement. Obviously if there's no end-to-end encryption, any cloud operator could still be coerced into searching for material server side, as that falls under the so-called third party doctrine.

wyager 5y ago

This is already a warrantless search that’s effectively controlled by the government. Obviously there’s enough chaff in the air to prevent that from being legally useful in any way.

zepto 5y ago
Nope. It’s not controlled by the government, and it’s not warrantless, since it is opt-in.
- Enginerrrd 5y ago
  Since the govt. supplies the hashes in an unauditable way, it absolutely is controlled by the government. What's to stop them from using hashes of non CSAM material?
  - zepto 5y ago
    The government doesn’t supply the hashes in an unauditable way, that is a totally false statement. The hashes are supplied by NCMEC, a non-profit which is auditable, not a secret government agency. In any case, even if a non-CSAM hash were somehow in the database, Apple reviews the images before making reports, and those reports are used in normal criminal prosecutions.
    - nullc 5y ago
      Courts have determined that for this purpose the NCMEC is an agent of the government. NEMEC is 99% funded by the government and its ability to handle child porn is directly deprived from a explicit legislative carveout for them by name. What they do would be a felony for you or I to do. The fact that they are technically non-profit rather than an agency makes them significantly less accountable to the public. We cannot FOIA their communications, their composition isn't subject to public review, we cannot vote them out. And we have no way to tell what their database contains, nor is there any avenue for redress should we somehow learn of an inappropriate listing. To the extent that you can say that they're not exactly a government agency, they absolutely have been deputized by the government.

jrockway 5y ago

Apple could also encrypt every upload to iCloud, and not have any scanning on the client, and still be able to say to the government "sure, you can have the files; we can't read them and neither can you". Apple wants to reduce your privacy from the government above and beyond what the law requires. The questions is: why?

colejohnson66 5y ago
The simple answer is: password resets. I’m sure majority of people would be very upset if they lost everything by forgetting a password.
- nullc 5y ago
  Doesn't the apple backup stuff work that way? The data is gone forever if you lose your password?
  - simondotau 5y ago
    Some, but not all. And if you still have access to a Mac or iOS device which remains associated to this iCloud account, the amount that is lost can be even less.
roody15 5y ago
The answer may be related to Pegasus software. Timeline: 1. Leaked documents show Pegasus software exploits all iphones using an exploit in iMessage 2. Apple releases security update (doesn’t patch imessage. exploit) 3. Apple announces CSAM client scanning coming soon 4. Apple releases another security update (still leaves iMessage exploit unpatched and used by Pegasus) …. Perhaps Apple is under pressure to provide a back door prior to patching a tool that may be widely used by governments around the world.
alisonkisk 5y ago
Because Apple doesn't want to be a child porn storage service. This is not a secret.

ok123456 5y ago

Also Fifth Amendment. People are being compelled to testify against themselves by running this CSAM scanner. Apple's end-to-end encryption was sold to users as exactly that. To all of a sudden introduce this scanner doesn't negate the expectation of privacy as that is how it was sold and marketed. There is an implied warranty of merchantability of how this service functions.

alisonkisk 5y ago

Are you a lawyer or legal scholar, or just guessing? The government can't compel warrantless searches of Apple. 3rd party doctrine means Apple can search your iCloud, and can give it away if they choose. Same as how Apple can search your phone if you run their software, and can give away whatever they find if they choose.