2 ms·

You mean one of the countries sales of devices just stopped in? And the other already was announced to be a US org? And you need the intersection of both?

perihelions 5y ago
- "And the other already was announced to be a US org?" Then one rogue employee in a US org could be sufficient to get selective root to every Apple device everywhere? That's easy for a nation-state adversary. Here's demonstrated examples: MBS had US-based moles in Twitter corporate spying on Khashoggi [0], and Xi had Chinese-based Zoom employees spying on dissidents in America [1]. [0] https://www.npr.org/2019/11/06/777098293/2-former-twitter-employees-charged-with-spying-for-saudi-arabia https://www.npr.org/2019/11/06/777098293/2-former-twitter-em... [1] https://www.justice.gov/opa/pr/china-based-executive-us-telecommunications-company-charged-disrupting-video-meetings https://www.justice.gov/opa/pr/china-based-executive-us-tele... That second example is topical: the Chinese state used their Zoom assets to attempt to frame Americans for CSAM possession. - "As detailed in the complaint, Jin’s co-conspirators created fake email accounts and Company-1 accounts in the names of others, including PRC political dissidents, to fabricate evidence that the hosts of and participants in the meetings to commemorate the Tiananmen Square massacre were supporting terrorist organizations, inciting violence or distributing child pornography. The fabricated evidence falsely asserted that the meetings included discussions of child abuse or exploitation, terrorism, racism or incitements to violence, and sometimes included screenshots of the purported participants’ user profiles featuring, for example, a masked person holding a flag resembling that of the Islamic State terrorist group."
- azinman2 5y ago
  You need the intersection of both, which this hypothetical doesn’t account for. In terms of planting, it’s much easier to do that already across the many, many cloud services that secretly scan on the backend. Going a whole weird route just to get images into a hash database, and then the matching images onto the device, that then get independent human verification seems totally unnecessary if you’re a state agent. Why do something so complicated when there are easier routes to go?
- bitwize 5y ago
  The FBI also has a way of "discovering" CSAM on the computers of uncooperative informants/suspects. https://www.pilotonline.com/nation-world/article_b02c37d2-ca4a-5e13-917d-018f60a6a30c.html https://www.pilotonline.com/nation-world/article_b02c37d2-ca...

perihelions 5y ago

- "And the other already was announced to be a US org?" Then one rogue employee in a US org could be sufficient to get selective root to every Apple device everywhere? That's easy for a nation-state adversary. Here's demonstrated examples: MBS had US-based moles in Twitter corporate spying on Khashoggi [0], and Xi had Chinese-based Zoom employees spying on dissidents in America [1]. [0] https://www.npr.org/2019/11/06/777098293/2-former-twitter-employees-charged-with-spying-for-saudi-arabia https://www.npr.org/2019/11/06/777098293/2-former-twitter-em... [1] https://www.justice.gov/opa/pr/china-based-executive-us-telecommunications-company-charged-disrupting-video-meetings https://www.justice.gov/opa/pr/china-based-executive-us-tele... That second example is topical: the Chinese state used their Zoom assets to attempt to frame Americans for CSAM possession. - "As detailed in the complaint, Jin’s co-conspirators created fake email accounts and Company-1 accounts in the names of others, including PRC political dissidents, to fabricate evidence that the hosts of and participants in the meetings to commemorate the Tiananmen Square massacre were supporting terrorist organizations, inciting violence or distributing child pornography. The fabricated evidence falsely asserted that the meetings included discussions of child abuse or exploitation, terrorism, racism or incitements to violence, and sometimes included screenshots of the purported participants’ user profiles featuring, for example, a masked person holding a flag resembling that of the Islamic State terrorist group."

azinman2 5y ago
You need the intersection of both, which this hypothetical doesn’t account for. In terms of planting, it’s much easier to do that already across the many, many cloud services that secretly scan on the backend. Going a whole weird route just to get images into a hash database, and then the matching images onto the device, that then get independent human verification seems totally unnecessary if you’re a state agent. Why do something so complicated when there are easier routes to go?
bitwize 5y ago
The FBI also has a way of "discovering" CSAM on the computers of uncooperative informants/suspects. https://www.pilotonline.com/nation-world/article_b02c37d2-ca4a-5e13-917d-018f60a6a30c.html https://www.pilotonline.com/nation-world/article_b02c37d2-ca...