297 ms·

The matches get sent to LEO for that validation. LEO has no incentive to exonerate you, their incentives are purely to identify wrongdoing. Any wrongdoing. H

by mulmen 5y ago

The matches get sent to LEO for that validation. LEO has no incentive to exonerate you, their incentives are purely to identify wrongdoing. Any wrongdoing. Having a image sent to LEO is effectively being accused of a crime. What prevents a judge from approving a search warrant on the basis of an image that matched a hash? The answer is, of course, “nothing”. What guarantee do we have that these matches aren’t used as a signal to some other automated extra-judicial search? Again, none. None of this is fantasy. Take a look at the no-fly list and and no-knock warrants and ask yourself if you really want an automated system making accusations to LEO. e: clarified that images are sent to LEO, not just hashes.

varispeed 5y ago
"There is no smoke without a fire" "Those targets will not meet themselves" "What if that person has CSAM but tried to obfuscate it. Would you forgive yourself if you let it go and it turned out you were wrong?"
ec109685 5y ago
No, it doesn't get sent to LEO. It gets run against another hash function that can't be guessed using this method, and an apple employee looks over it.
- mulmen 5y ago
  Thanks, I updated my post to clarify that images are sent to LEO, not hashes.
Natsu 5y ago
I can see it being used to forcibly start an investigation of someone, but the image itself is not CP and would be quickly proven as such assuming you have a halfway competent lawyer. There's a fair point in there about public defenders not meeting that bar, at least in terms of the quality of their representation given the amount of work they have, though.
- mulmen 5y ago
  Being accused of a crime is not free. There is a cost in terms of time and reputation, even if public defenders or your own lawyers are competent and you are eventually exonerated.
- laurent92 5y ago
  > but the image itself is not CP and would be quickly proven as such assuming you have a halfway competent lawyer. Lawyers aren’t always doing their maximum. It doesn’t matter that they get paid, you also have to be among their top important customers, just like aircon repairmen. Also, the picture is not CP but by that time, the phone is already entirely searched.
snowwrestler 5y ago
The idea that a federal judge would approve a warrant based on a hash collision is fantasy. Assuming they even understand what a hash collision is (most will not), their first question to a prosecutor will be “have you confirmed this is illegal material?” Prosecutors are allowed to look at the original files and are expected to do so before seeking a warrant. Law enforcement has no incentive to exonerate you, but they have tremendous incentive not to waste everyone’s time, including their own, on fake cases with little chance of conviction.
- mulmen 5y ago
  I’d rather not be in a position that I have to trust a federal judge. Nor do I want federal prosecutors looking at my data.
- nullc 5y ago
  > “have you confirmed this is illegal material? Sadly, in the US prosecutors regularly mislead the court because our adversarial system of law is seen by many to obligate them to zealously prosecute their case up to the boundary of the law. (That the prosecutor should conceal evidence, mislead, exaggerate, right up to the point where any further and their actions would be an unambiguous crime) As a result, there have been child porn prosecutions over totally legal material rescued only by the actress in question showing up in the court. ( https://www.crimeandfederalism.com/page/61/ https://www.crimeandfederalism.com/page/61/ ) At the end of the day, Apple's decision to reprogram their customer's private property to snoop on their users private files and report on them creates a risk for those users. The risk may arguably be small, at least today. But it is a risk none the less. We don't need trillion dollar corporations snooping on users phones like masked vigilante crime fighters. Batman is fiction, and in even the Dark Knight when he spied on everyone's phones it was clearly portrayed as an erosion of his moral character out of desperation.

by mulmen 5y ago

varispeed 5y ago

"There is no smoke without a fire" "Those targets will not meet themselves" "What if that person has CSAM but tried to obfuscate it. Would you forgive yourself if you let it go and it turned out you were wrong?"

ec109685 5y ago

No, it doesn't get sent to LEO. It gets run against another hash function that can't be guessed using this method, and an apple employee looks over it.

mulmen 5y ago
Thanks, I updated my post to clarify that images are sent to LEO, not hashes.

Natsu 5y ago

I can see it being used to forcibly start an investigation of someone, but the image itself is not CP and would be quickly proven as such assuming you have a halfway competent lawyer. There's a fair point in there about public defenders not meeting that bar, at least in terms of the quality of their representation given the amount of work they have, though.

mulmen 5y ago
Being accused of a crime is not free. There is a cost in terms of time and reputation, even if public defenders or your own lawyers are competent and you are eventually exonerated.
laurent92 5y ago
> but the image itself is not CP and would be quickly proven as such assuming you have a halfway competent lawyer. Lawyers aren’t always doing their maximum. It doesn’t matter that they get paid, you also have to be among their top important customers, just like aircon repairmen. Also, the picture is not CP but by that time, the phone is already entirely searched.

snowwrestler 5y ago

The idea that a federal judge would approve a warrant based on a hash collision is fantasy. Assuming they even understand what a hash collision is (most will not), their first question to a prosecutor will be “have you confirmed this is illegal material?” Prosecutors are allowed to look at the original files and are expected to do so before seeking a warrant. Law enforcement has no incentive to exonerate you, but they have tremendous incentive not to waste everyone’s time, including their own, on fake cases with little chance of conviction.

mulmen 5y ago
I’d rather not be in a position that I have to trust a federal judge. Nor do I want federal prosecutors looking at my data.
nullc 5y ago
> “have you confirmed this is illegal material? Sadly, in the US prosecutors regularly mislead the court because our adversarial system of law is seen by many to obligate them to zealously prosecute their case up to the boundary of the law. (That the prosecutor should conceal evidence, mislead, exaggerate, right up to the point where any further and their actions would be an unambiguous crime) As a result, there have been child porn prosecutions over totally legal material rescued only by the actress in question showing up in the court. ( https://www.crimeandfederalism.com/page/61/ https://www.crimeandfederalism.com/page/61/ ) At the end of the day, Apple's decision to reprogram their customer's private property to snoop on their users private files and report on them creates a risk for those users. The risk may arguably be small, at least today. But it is a risk none the less. We don't need trillion dollar corporations snooping on users phones like masked vigilante crime fighters. Batman is fiction, and in even the Dark Knight when he spied on everyone's phones it was clearly portrayed as an erosion of his moral character out of desperation.