4 ms·

While looking up something, I came across this article (I believe from before Apple's original announcement): https://www.wired.co.uk/article/whatsapp-encryptio

While looking up something, I came across this article (I believe from before Apple's original announcement): https://www.wired.co.uk/article/whatsapp-encryption-child-abuse https://www.wired.co.uk/article/whatsapp-encryption-child-ab... It's interesting in that it talks about both server and client side scanning, and some of the things that WhatsApp does. An interesting fact from the article: in 2020, Whatsapp made 400,000 reports to the NCMEC. Apple: 265

cwizou 5y ago
Yep, Apple currently only scans iCloud Mail attachements (I believe they confirmed this, don't have the source at hand though), which explains the discrepancy. There's a big difference though between scanning a library (which is closer to what DropBox/OneDrive are doing) and when it's messaging platform whose ultimate goal is communication between people. It does make sense that those catch way more. If Apple had roll those scans on iMessage attachements (which they didn't planned to, though the feature looked to be designed for it way more than it was for a library scan), you would probably see comparable numbers (modulo those platforms relative marketshares). One big problem though is are those large numbers actually actionable ? I think I remember seeing a quote from Swiss (?) law enforcement that complained that the reports they got from NCMEC were nearly all of the time unactionable. There are possibly many reasons from this, it could be differences in local laws, algorithms that wrongly report things, or other factors (maybe not enough to identify the user of the acount, etc). This is where one feature of Apple's design was a bit better: they didn't plan to report every single occurence, but would only if 30 such images were detected. Part of the reason they did was because of the imperfections of the NeuralHash mechanism, sure, but in the end it doesn't matter. One can argue doing this would at least generate more actionnable reports. It shouldn't be a numbers game.
- CubsFan1060 5y ago
  The article touched on the actionable parts. "They say it is “highly unlikely” that a search warrant could be made from a tip that does not include content “and instead only includes IP data and an indication from an algorithm that there is a high probability of suspicious or anomalous activity”." It sounds like simply being able to say "This user was messaging with 4 known offenders,and sending something the size of images" is unlikely to be helpful to law enforcement.
  - ComputerGuru 5y ago
    Boy do I have a bridge to sell you. Search warrants get signed for far, far less all the time.
jliptzin 5y ago
And Facebook: 20 million reports last year. That is an astounding number. Does anyone really think we're only another 20 million reports a year away from solving the CSAM problem?
- CubsFan1060 5y ago
  I have no idea what the right answer is, however "solving" implies that the states are "huge problem" and "no problem". I might say that it's possible there are actions that can reduce, but not eliminate, the problem. What if another 20 million reports saved one child from exploitation? 10 children? 1000 children? At some level, this boils down to a society question. We all agree CSAM is evil. How does it stack up against other things we think are evil? I fear that, in the end, there is no middle ground that includes eliminating CSAM and keeping 100% privacy.

cwizou 5y ago

Yep, Apple currently only scans iCloud Mail attachements (I believe they confirmed this, don't have the source at hand though), which explains the discrepancy. There's a big difference though between scanning a library (which is closer to what DropBox/OneDrive are doing) and when it's messaging platform whose ultimate goal is communication between people. It does make sense that those catch way more. If Apple had roll those scans on iMessage attachements (which they didn't planned to, though the feature looked to be designed for it way more than it was for a library scan), you would probably see comparable numbers (modulo those platforms relative marketshares). One big problem though is are those large numbers actually actionable ? I think I remember seeing a quote from Swiss (?) law enforcement that complained that the reports they got from NCMEC were nearly all of the time unactionable. There are possibly many reasons from this, it could be differences in local laws, algorithms that wrongly report things, or other factors (maybe not enough to identify the user of the acount, etc). This is where one feature of Apple's design was a bit better: they didn't plan to report every single occurence, but would only if 30 such images were detected. Part of the reason they did was because of the imperfections of the NeuralHash mechanism, sure, but in the end it doesn't matter. One can argue doing this would at least generate more actionnable reports. It shouldn't be a numbers game.

CubsFan1060 5y ago
The article touched on the actionable parts. "They say it is “highly unlikely” that a search warrant could be made from a tip that does not include content “and instead only includes IP data and an indication from an algorithm that there is a high probability of suspicious or anomalous activity”." It sounds like simply being able to say "This user was messaging with 4 known offenders,and sending something the size of images" is unlikely to be helpful to law enforcement.
- ComputerGuru 5y ago
  Boy do I have a bridge to sell you. Search warrants get signed for far, far less all the time.

jliptzin 5y ago

And Facebook: 20 million reports last year. That is an astounding number. Does anyone really think we're only another 20 million reports a year away from solving the CSAM problem?

CubsFan1060 5y ago
I have no idea what the right answer is, however "solving" implies that the states are "huge problem" and "no problem". I might say that it's possible there are actions that can reduce, but not eliminate, the problem. What if another 20 million reports saved one child from exploitation? 10 children? 1000 children? At some level, this boils down to a society question. We all agree CSAM is evil. How does it stack up against other things we think are evil? I fear that, in the end, there is no middle ground that includes eliminating CSAM and keeping 100% privacy.