4 ms·

My prediction is that client-side CSAM scanning is indeed dead, but Apple will make the “easy” decision to perform server-side scanning. The problem is that thi

My prediction is that client-side CSAM scanning is indeed dead, but Apple will make the “easy” decision to perform server-side scanning. The problem is that this decision will lock them out of offering an (increasingly standard) E2EE backup capability. I don’t know that the Apple execs have grappled with the implications of this, long term. But at least it’s an improvement.

giansegato 5y ago
They've been already doing server side CSAM, for a while, on iCloud pics. Their issue was targeting all media that wasn't uploaded.
- snowwrestler 5y ago
  The system they proposed would only have scanned images in the process of being uploaded—so, the opposite of your 2nd sentence. There was some reporting that Apple does server-side CSAM scanning, but based on the volume of matches they report, it must be extremely limited. Apple never said it this way, but many people assumed that Apple designed this client-side scanning system so that they could then encrypt iCloud data with client-side keys, which would provide end to end encryption for customer backups… and prevent any server-side scanning. This is likely what Matthew is referring to.
  - zerkten 5y ago
    From a read of the expert opinions on the CSAM topic when this blew up. From that, it seemed like you had to be all in, or keeping out of active CSAM scanning/monitoring for legal reasons. They noted the match volume and came to the same conclusion. With the attention I don't see how Apple can delay taking some action here. A new external liability that can be attacked in different ways. Either they need to level up the CSAM scanning server-side to increase compliance, or they need to reimplement the client-side approach. The latter approach is probably much better from their perspective for various reasons. Ultimately, they might have been better giving this a lower profile overall and effectively have sought public attention of law enforcement to provide some cover. The authorities are going to get this in some fashion eventually.
  - judge2020 5y ago
    > but based on the volume of matches they report, it must be extremely limited. For reference: > According to NCMEC, I submitted 608 reports to NCMEC in 2019, and 523 reports in 2020. In those same years, Apple submitted 205 and 265 reports (respectively). It isn't that Apple doesn't receive more picture than my service, or that they don't have more CP than I receive. Rather, it's that they don't seem to notice and therefore, don't report. https://www.hackerfactor.com/blog/index.php?/archives/929-One-Bad-Apple.html https://www.hackerfactor.com/blog/index.php?/archives/929-On...
    - snowwrestler 5y ago
      Thanks, that is the reference I was thinking of.
jamil7 5y ago
> The problem is that this decision will lock them out of offering an (increasingly standard) E2EE backup capability Is this a given?
- willis936 5y ago
  It's not really encrypted if you can tell what the data is. The two capabilities are entirely mutually exclusive.
bangonkeyboard 5y ago
Thanks for raising the initial alarm on this.
gonehome 5y ago
I’m hoping they’re just going to announce it alongside e2ee rather than not doing it at all in favor of server side unencrypted scanning. It was a mistake to announce it in isolation as seen by this blowback because most people don’t understand or care about the actual details and just loudly complain. Similar to the dismissal of the privacy preserving Bluetooth exposure notifications. Dumb knee-jerk dismissals imo that end up with worse outcomes for everyone.
zionic 5y ago
The only acceptable solution is full E2EE for all Apple services. Nothing else is satisfactory at this point. They need to make this step to regain their user's trust.
- judge2020 5y ago
  This isn't exactly in Apple's hands. https://www.bbc.com/news/technology-51207744 https://www.bbc.com/news/technology-51207744 https://www.eff.org/deeplinks/2019/12/senate-judiciary-committee-wants-everyone-know-its-concerned-about-encryption https://www.eff.org/deeplinks/2019/12/senate-judiciary-commi...
  - zionic 5y ago
    No law is on the books blocking encryption. Apple needs to nut up and ship full E2EE, daring the politicians to do anything about it. Let's see how big they talk when it's their political careers on the line.
FabHK 5y ago
Maybe they can offer a choice? You can pick a) no backups b) iCloud backups with E2EE and privacy preserving CSAM scanning as suggested by Apple (private set intersection, half client side, half server side) c) iCloud backups, unencrypted, with CSAM scanning server side (like all other cloud services) I know what I'd choose!
- Copernicron 5y ago
  You're forgetting the last option, which myself and others use: d) encrypted offline backups that never touch iCloud I don't use iCloud for anything at all. Any sort of client-side scanner seriously compromises my privacy for no good reason. I am not a criminal. I don't deserve to be treated like one.
  - FabHK 5y ago
    If you don't use iCloud, then the proposed Apple solution (b) does not affect you at all.

giansegato 5y ago

They've been already doing server side CSAM, for a while, on iCloud pics. Their issue was targeting all media that wasn't uploaded.

snowwrestler 5y ago
The system they proposed would only have scanned images in the process of being uploaded—so, the opposite of your 2nd sentence. There was some reporting that Apple does server-side CSAM scanning, but based on the volume of matches they report, it must be extremely limited. Apple never said it this way, but many people assumed that Apple designed this client-side scanning system so that they could then encrypt iCloud data with client-side keys, which would provide end to end encryption for customer backups… and prevent any server-side scanning. This is likely what Matthew is referring to.
- zerkten 5y ago
  From a read of the expert opinions on the CSAM topic when this blew up. From that, it seemed like you had to be all in, or keeping out of active CSAM scanning/monitoring for legal reasons. They noted the match volume and came to the same conclusion. With the attention I don't see how Apple can delay taking some action here. A new external liability that can be attacked in different ways. Either they need to level up the CSAM scanning server-side to increase compliance, or they need to reimplement the client-side approach. The latter approach is probably much better from their perspective for various reasons. Ultimately, they might have been better giving this a lower profile overall and effectively have sought public attention of law enforcement to provide some cover. The authorities are going to get this in some fashion eventually.
- judge2020 5y ago
  > but based on the volume of matches they report, it must be extremely limited. For reference: > According to NCMEC, I submitted 608 reports to NCMEC in 2019, and 523 reports in 2020. In those same years, Apple submitted 205 and 265 reports (respectively). It isn't that Apple doesn't receive more picture than my service, or that they don't have more CP than I receive. Rather, it's that they don't seem to notice and therefore, don't report. https://www.hackerfactor.com/blog/index.php?/archives/929-One-Bad-Apple.html https://www.hackerfactor.com/blog/index.php?/archives/929-On...
  - snowwrestler 5y ago
    Thanks, that is the reference I was thinking of.

jamil7 5y ago

> The problem is that this decision will lock them out of offering an (increasingly standard) E2EE backup capability Is this a given?

willis936 5y ago
It's not really encrypted if you can tell what the data is. The two capabilities are entirely mutually exclusive.

bangonkeyboard 5y ago

Thanks for raising the initial alarm on this.

gonehome 5y ago

I’m hoping they’re just going to announce it alongside e2ee rather than not doing it at all in favor of server side unencrypted scanning. It was a mistake to announce it in isolation as seen by this blowback because most people don’t understand or care about the actual details and just loudly complain. Similar to the dismissal of the privacy preserving Bluetooth exposure notifications. Dumb knee-jerk dismissals imo that end up with worse outcomes for everyone.

zionic 5y ago

The only acceptable solution is full E2EE for all Apple services. Nothing else is satisfactory at this point. They need to make this step to regain their user's trust.

judge2020 5y ago
This isn't exactly in Apple's hands. https://www.bbc.com/news/technology-51207744 https://www.bbc.com/news/technology-51207744 https://www.eff.org/deeplinks/2019/12/senate-judiciary-committee-wants-everyone-know-its-concerned-about-encryption https://www.eff.org/deeplinks/2019/12/senate-judiciary-commi...
- zionic 5y ago
  No law is on the books blocking encryption. Apple needs to nut up and ship full E2EE, daring the politicians to do anything about it. Let's see how big they talk when it's their political careers on the line.

FabHK 5y ago

Maybe they can offer a choice? You can pick a) no backups b) iCloud backups with E2EE and privacy preserving CSAM scanning as suggested by Apple (private set intersection, half client side, half server side) c) iCloud backups, unencrypted, with CSAM scanning server side (like all other cloud services) I know what I'd choose!

Copernicron 5y ago
You're forgetting the last option, which myself and others use: d) encrypted offline backups that never touch iCloud I don't use iCloud for anything at all. Any sort of client-side scanner seriously compromises my privacy for no good reason. I am not a criminal. I don't deserve to be treated like one.
- FabHK 5y ago
  If you don't use iCloud, then the proposed Apple solution (b) does not affect you at all.