4 ms·

The only client-side scanning proposal we’ve ever seen (Apple and NCMEC’s 2021 photo scanning proposal) didn’t even address encrypted messaging. It worked on pr

The only client-side scanning proposal we’ve ever seen (Apple and NCMEC’s 2021 photo scanning proposal) didn’t even address encrypted messaging. It worked on private photo libraries on your phone. I think it’s very important to reiterate that the targets here aren’t communications between criminals: it’s your private data.

hot_gril 4y ago
Not the only one. At the same time, they announced a separate scanner for incoming inappropriate photos over iMessage as a parental control feature. Unlike the photo library scanner, this one actually got released. https://www.apple.com/child-safety/ https://www.apple.com/child-safety/
- matthewdgreen 4y ago
  That feature did not report users to the police. It did notify parents automatically, however, if you were a child in a family account. After some feedback from child protection advocates they removed the mandatory parental notification and made it a button that the child has to press.
  - hot_gril 4y ago
    The police report was the wackiest part of the other feature, yeah.
jodrellblank 4y ago
It would scan photos you were uploading to iCloud, not private photo libraries on your phone. I'm sure you'll agree it's important to correct such a misunderstanding as one of those is a lot more invasive than the other.
- hot_gril 4y ago
  Yeah, important to mention that. Still, I don't want my phone to even be capable of doing that, nor do I see the reason behind it when iCloud could just do the scanning itself. That's one big step closer to the described full-private scanning (and just a flag flip away).
  - bombcar 4y ago
    The supposed argument was that they wanted to keep the scanning they do in iCloud now (I believe they do it) and yet make iCloud encrypted so that they can't see the images once they leave your device. So they move the scanning to the device.
    - hot_gril 4y ago
      Did Apple actually say they wanted to do e2ee iCloud photos when they announced CSAM scanning, or were people only speculating this? I don't remember / can't find an announcement on that. Also curious if there's some law preventing them from doing e2ee without the scanning.
      - bombcar 4y ago
        I believe it was speculation based on them saying they wanted e2ee (and now it's available IIRC). It honestly seems to me like they thought they could negotiate a middle ground without pissing off the Feds or the customers, but they maneuvered it quite badly.
        hot_gril 4y ago
        > now it's available IIRC Oh cool, didn't know that. It's this new "advanced data protection" feature that makes everything in iCloud e2ee except the classic mail/contacts/calendars combo that wouldn't really work with that. https://support.apple.com/en-us/HT202303 https://support.apple.com/en-us/HT202303 is a nice resource on this, and I wish more companies would publish things like this.
- giantrobot 4y ago
  It would start at only scanning content that was going to be uploaded to iCloud. There's literally nothing stopping the process from scanning all images whether they're going to be uploaded to iCloud or not. Such an expansion would use the exact same justification as the iCloud-bound content scanning. It's a slippery slope that ends up with your phone/computer snooping on texts, call contents, or anything else and then submitting your "crimes" to the authorities.
  - jodrellblank 4y ago
    They could have designed it to do that in the first place, and not announced it at all just hid it away in a point release. They didn't. > "Such an expansion would use the exact same justification as the iCloud-bound content scanning." One of the justifications was that Apple are/could be legally responsible for criminal images hosted on their servers, that exact same justification wouldn't apply to offline content scanning. > "It's a slippery slope that ends up with your phone/computer snooping on texts, call contents, or anything else and then submitting your "crimes" to the authorities." Not "crimes" in quotes, crimes without quotes. Generally people think law enforcement is important, especially regarding crimes against children. "A slippery slope" which leads criminals being punished is not the argument winning logical fallacy you think it is. The argument against it is around invasion of privacy, rights not to self-incriminate or to remain silent, ownership of device and software, freedom from unreasonable search without prior evidence, whether you can be found guilty by algorithm, et al.
    - giantrobot 4y ago
      > Not "crimes" in quotes, crimes without quotes. Generally people think law enforcement is important, especially regarding crimes against children. "A slippery slope" which leads criminals being punished is not the argument winning logical fallacy you think it is. You're missing my point. Content scanning will start with the Four Horsemen of the Infopocalypse[0]. Then it'll move on to "crimes" like blogging about a public figure[1]. [0] https://en.wikipedia.org/wiki/Four_Horsemen_of_the_Infocalypse https://en.wikipedia.org/wiki/Four_Horsemen_of_the_Infocalyp... [1] https://www.flsenate.gov/Session/Bill/2023/1316/BillText/Filed/PDF https://www.flsenate.gov/Session/Bill/2023/1316/BillText/Fil...
- eastbound 4y ago
  > It would scan photos you were uploading to iCloud, not private photo There was no way to separate the private photos from iCloud-uploaded photos. It was all-or-nothing, like Android permissions: “Allow govt to scan all your private pictures, or do you wish to have no backup?” I was perfectly feasible to design the ability to have private photos, but Apple chose not to. Or Apple, in collaboration with the government, chose not to.
  - jodrellblank 4y ago
    The wording "scan your phone" misleads by implying that the photos are scanned because they are on your phone, when really the photos would be scanned because you sharing them with a third party, by the third party. Yes it was all-or-nothing, what it wasn't is all-, there was a nothing and that nothing would have kept your photos private. (Yes it was feasible to design the ability to have a local photo store which isn't uploaded to iCloud, separate from other photos which are, and call it "private photos", but that's another matter).
- ssss11 4y ago
  If you have iCloud backup setup, does it upload all photos from your private photo libraries to iCloud?
  - matthewdgreen 4y ago
    If you turn on ADP those photos will be encrypted with a key Apple doesn’t have. They will still be private photos, of course. Even turning on unencrypted backup doesn’t make my private photos not-private.
    - jodrellblank 4y ago
      You say that sharing your photos, unencrypted, with a third party you don't trust, doesn't make them "not-private" and you accused me of twisting language. Yes there can be private conversations between two people, but there can't be private conversations between two people where one of them isn't trusted but can hear the conversation and simultaneously, what, can't hear it to keep it private?
- alwayslikethis 4y ago
  It's already happening, and scans even with iCloud turned off: https://sneak.berlin/20230115/macos-scans-your-local-files-now/ https://sneak.berlin/20230115/macos-scans-your-local-files-n...
  - shadowfiend 4y ago
    This is a person who is linking to an article that literally says the opposite of what they are claiming it says. > The media erroneously reported [a statement from September 2021] as Apple reversing course. Linking to an article from December 22, 2022 in which Apple is quoted as literally saying “We have further decided to not move forward with our previously proposed CSAM detection tool for iCloud Photos.”, ie actually and literally reversing course. If this person cannot comprehend an article, should I trust that they actually checked that what they were seeing was what they were paranoid about? Btw, the screenshot shows an interaction with api.smoot.apple.com, which is known to be used for spotlight and related services: https://news.ycombinator.com/item?id=8479958 https://news.ycombinator.com/item?id=8479958 ; mediaanalysisd is used for visual lookup, where macOS tries to identify landmarks and other items in an image to help you find more information about it (https://appleinsider.com/articles/23/01/21/tests-confirm-macos-finder-isnt-scanning-for-csam-images https://appleinsider.com/articles/23/01/21/tests-confirm-mac...). In short, paranoid people are good to use as indicators for further investigation, but are rarely to be trusted as sole sources—even less so when they attempt to ascribe intent.
    - alwayslikethis 4y ago
      "erroneously" is referring to his later claims about Apple still continuing to scan. I guess it's a poor choice of words, but I don't see much problems with that. Your note about that domain is interesting though. I don't regularly use Apple devices, so I'm not particularly concerned by that anyways.
- matthewdgreen 4y ago
  It would scan the private photo library on your phone. There is no “public” photo library on my phone, and the default photo library contains extremely personal photos that I consider private and have not shared with anyone else, so I see no value in torturing language to pretend that this is not my private photo library. You are correct that it would only scan my private photos conditioned on a switch being turned on that would also cause those photos to be uploaded to my private cloud backup account. However this does not make that data any less private to me, and it is very different than scanning my photos in the cloud. Since late 2022 Apple has enabled Advanced Data Protection, which encrypts all photos before they’re uploaded to cloud storage. With ADP on, my photo library is “private” not just in the common-language sense (it contains extremely personal data I have not shared with others) but also in an opinionated technical sense that these files are accessible only to me. If Apple’s CSAM scanner was deployed today, it would be scanning those photos in cleartext on your phone before unreadable data was sent up to the cloud. You could argue that Apple was making a trade: “hey, it doesn’t matter whether we can read the private data you’re storing, the price of sending even unreadable encrypted private data to our infrastructure is that you must run local software that scans the private photos on your phone,” and that’s a trade you might accept or reject on the merits. However I think it’s extremely important to say it exactly this way and not play language games. Apple was going to mandate local scanning of private photos as the cost of using their infrastructure even to store opaque private bits.
  - jodrellblank 4y ago
    At the time of the announcement in 2021 there were no encrypted photos in iCloud. There was "private photo library only on your device" and "photos shared with Apple (not private)". The scanner would not have scanned private device-only photos. > "If Apple’s CSAM scanner was deployed today, it would be scanning those photos in cleartext on your phone before unreadable data was sent up to the cloud." Or enabling Advanced Data Protection could have disabled the scanner, we don't know. Even if it went the way you said, you could still not use iCloud and have private photos on your device, whereas your phrasing is trying to imply that there would be no option to do that.
    - 4y ago
hulitu 4y ago
You forgot about Google. (Dad sends child photo to doctor)
- zirgs 4y ago
  What's especially fucked up in that case is that Google suspended his account and didn't restore it even after the cops closed the case and said that it wasn't a crime. So the lesson is clear - avoid Google as much as possible and use services from separate companies. Email from one company, Chat/IM from a different one and so on. So that if one of your accounts gets suspended for one reason or another - it would not affect the rest.
  - hot_gril 4y ago
    I look at it as, split apart cloud things that are totally unrelated to the rest. Like there's no way my YouTube creator account would be the same as my personal Gmail/calendar/whatever. And don't put photos in the cloud at all unless it's e2ee. Chat/IM and email in the same place would make sense cause they're related things, except nobody uses Google's chat products. It's nice how iPhones do the neat AI photo search and montages all client-side, with my Mac backing things up. They're really catering to the less common use case there.
- hot_gril 4y ago
  That was a server-side scan IIRC.

hot_gril 4y ago

Not the only one. At the same time, they announced a separate scanner for incoming inappropriate photos over iMessage as a parental control feature. Unlike the photo library scanner, this one actually got released. https://www.apple.com/child-safety/ https://www.apple.com/child-safety/

matthewdgreen 4y ago
That feature did not report users to the police. It did notify parents automatically, however, if you were a child in a family account. After some feedback from child protection advocates they removed the mandatory parental notification and made it a button that the child has to press.
- hot_gril 4y ago
  The police report was the wackiest part of the other feature, yeah.

jodrellblank 4y ago

It would scan photos you were uploading to iCloud, not private photo libraries on your phone. I'm sure you'll agree it's important to correct such a misunderstanding as one of those is a lot more invasive than the other.

hot_gril 4y ago
Yeah, important to mention that. Still, I don't want my phone to even be capable of doing that, nor do I see the reason behind it when iCloud could just do the scanning itself. That's one big step closer to the described full-private scanning (and just a flag flip away).
- bombcar 4y ago
  The supposed argument was that they wanted to keep the scanning they do in iCloud now (I believe they do it) and yet make iCloud encrypted so that they can't see the images once they leave your device. So they move the scanning to the device.
  - hot_gril 4y ago
    Did Apple actually say they wanted to do e2ee iCloud photos when they announced CSAM scanning, or were people only speculating this? I don't remember / can't find an announcement on that. Also curious if there's some law preventing them from doing e2ee without the scanning.
    - bombcar 4y ago
      I believe it was speculation based on them saying they wanted e2ee (and now it's available IIRC). It honestly seems to me like they thought they could negotiate a middle ground without pissing off the Feds or the customers, but they maneuvered it quite badly.
      - hot_gril 4y ago
        > now it's available IIRC Oh cool, didn't know that. It's this new "advanced data protection" feature that makes everything in iCloud e2ee except the classic mail/contacts/calendars combo that wouldn't really work with that. https://support.apple.com/en-us/HT202303 https://support.apple.com/en-us/HT202303 is a nice resource on this, and I wish more companies would publish things like this.
giantrobot 4y ago
It would start at only scanning content that was going to be uploaded to iCloud. There's literally nothing stopping the process from scanning all images whether they're going to be uploaded to iCloud or not. Such an expansion would use the exact same justification as the iCloud-bound content scanning. It's a slippery slope that ends up with your phone/computer snooping on texts, call contents, or anything else and then submitting your "crimes" to the authorities.
- jodrellblank 4y ago
  They could have designed it to do that in the first place, and not announced it at all just hid it away in a point release. They didn't. > "Such an expansion would use the exact same justification as the iCloud-bound content scanning." One of the justifications was that Apple are/could be legally responsible for criminal images hosted on their servers, that exact same justification wouldn't apply to offline content scanning. > "It's a slippery slope that ends up with your phone/computer snooping on texts, call contents, or anything else and then submitting your "crimes" to the authorities." Not "crimes" in quotes, crimes without quotes. Generally people think law enforcement is important, especially regarding crimes against children. "A slippery slope" which leads criminals being punished is not the argument winning logical fallacy you think it is. The argument against it is around invasion of privacy, rights not to self-incriminate or to remain silent, ownership of device and software, freedom from unreasonable search without prior evidence, whether you can be found guilty by algorithm, et al.
  - giantrobot 4y ago
    > Not "crimes" in quotes, crimes without quotes. Generally people think law enforcement is important, especially regarding crimes against children. "A slippery slope" which leads criminals being punished is not the argument winning logical fallacy you think it is. You're missing my point. Content scanning will start with the Four Horsemen of the Infopocalypse[0]. Then it'll move on to "crimes" like blogging about a public figure[1]. [0] https://en.wikipedia.org/wiki/Four_Horsemen_of_the_Infocalypse https://en.wikipedia.org/wiki/Four_Horsemen_of_the_Infocalyp... [1] https://www.flsenate.gov/Session/Bill/2023/1316/BillText/Filed/PDF https://www.flsenate.gov/Session/Bill/2023/1316/BillText/Fil...
eastbound 4y ago
> It would scan photos you were uploading to iCloud, not private photo There was no way to separate the private photos from iCloud-uploaded photos. It was all-or-nothing, like Android permissions: “Allow govt to scan all your private pictures, or do you wish to have no backup?” I was perfectly feasible to design the ability to have private photos, but Apple chose not to. Or Apple, in collaboration with the government, chose not to.
- jodrellblank 4y ago
  The wording "scan your phone" misleads by implying that the photos are scanned because they are on your phone, when really the photos would be scanned because you sharing them with a third party, by the third party. Yes it was all-or-nothing, what it wasn't is all-, there was a nothing and that nothing would have kept your photos private. (Yes it was feasible to design the ability to have a local photo store which isn't uploaded to iCloud, separate from other photos which are, and call it "private photos", but that's another matter).
ssss11 4y ago
If you have iCloud backup setup, does it upload all photos from your private photo libraries to iCloud?
- matthewdgreen 4y ago
  If you turn on ADP those photos will be encrypted with a key Apple doesn’t have. They will still be private photos, of course. Even turning on unencrypted backup doesn’t make my private photos not-private.
  - jodrellblank 4y ago
    You say that sharing your photos, unencrypted, with a third party you don't trust, doesn't make them "not-private" and you accused me of twisting language. Yes there can be private conversations between two people, but there can't be private conversations between two people where one of them isn't trusted but can hear the conversation and simultaneously, what, can't hear it to keep it private?
alwayslikethis 4y ago
It's already happening, and scans even with iCloud turned off: https://sneak.berlin/20230115/macos-scans-your-local-files-now/ https://sneak.berlin/20230115/macos-scans-your-local-files-n...
- shadowfiend 4y ago
  This is a person who is linking to an article that literally says the opposite of what they are claiming it says. > The media erroneously reported [a statement from September 2021] as Apple reversing course. Linking to an article from December 22, 2022 in which Apple is quoted as literally saying “We have further decided to not move forward with our previously proposed CSAM detection tool for iCloud Photos.”, ie actually and literally reversing course. If this person cannot comprehend an article, should I trust that they actually checked that what they were seeing was what they were paranoid about? Btw, the screenshot shows an interaction with api.smoot.apple.com, which is known to be used for spotlight and related services: https://news.ycombinator.com/item?id=8479958 https://news.ycombinator.com/item?id=8479958 ; mediaanalysisd is used for visual lookup, where macOS tries to identify landmarks and other items in an image to help you find more information about it (https://appleinsider.com/articles/23/01/21/tests-confirm-macos-finder-isnt-scanning-for-csam-images https://appleinsider.com/articles/23/01/21/tests-confirm-mac...). In short, paranoid people are good to use as indicators for further investigation, but are rarely to be trusted as sole sources—even less so when they attempt to ascribe intent.
  - alwayslikethis 4y ago
    "erroneously" is referring to his later claims about Apple still continuing to scan. I guess it's a poor choice of words, but I don't see much problems with that. Your note about that domain is interesting though. I don't regularly use Apple devices, so I'm not particularly concerned by that anyways.
matthewdgreen 4y ago
It would scan the private photo library on your phone. There is no “public” photo library on my phone, and the default photo library contains extremely personal photos that I consider private and have not shared with anyone else, so I see no value in torturing language to pretend that this is not my private photo library. You are correct that it would only scan my private photos conditioned on a switch being turned on that would also cause those photos to be uploaded to my private cloud backup account. However this does not make that data any less private to me, and it is very different than scanning my photos in the cloud. Since late 2022 Apple has enabled Advanced Data Protection, which encrypts all photos before they’re uploaded to cloud storage. With ADP on, my photo library is “private” not just in the common-language sense (it contains extremely personal data I have not shared with others) but also in an opinionated technical sense that these files are accessible only to me. If Apple’s CSAM scanner was deployed today, it would be scanning those photos in cleartext on your phone before unreadable data was sent up to the cloud. You could argue that Apple was making a trade: “hey, it doesn’t matter whether we can read the private data you’re storing, the price of sending even unreadable encrypted private data to our infrastructure is that you must run local software that scans the private photos on your phone,” and that’s a trade you might accept or reject on the merits. However I think it’s extremely important to say it exactly this way and not play language games. Apple was going to mandate local scanning of private photos as the cost of using their infrastructure even to store opaque private bits.
- jodrellblank 4y ago
  At the time of the announcement in 2021 there were no encrypted photos in iCloud. There was "private photo library only on your device" and "photos shared with Apple (not private)". The scanner would not have scanned private device-only photos. > "If Apple’s CSAM scanner was deployed today, it would be scanning those photos in cleartext on your phone before unreadable data was sent up to the cloud." Or enabling Advanced Data Protection could have disabled the scanner, we don't know. Even if it went the way you said, you could still not use iCloud and have private photos on your device, whereas your phrasing is trying to imply that there would be no option to do that.
  - 4y ago

hulitu 4y ago

You forgot about Google. (Dad sends child photo to doctor)

zirgs 4y ago
What's especially fucked up in that case is that Google suspended his account and didn't restore it even after the cops closed the case and said that it wasn't a crime. So the lesson is clear - avoid Google as much as possible and use services from separate companies. Email from one company, Chat/IM from a different one and so on. So that if one of your accounts gets suspended for one reason or another - it would not affect the rest.
- hot_gril 4y ago
  I look at it as, split apart cloud things that are totally unrelated to the rest. Like there's no way my YouTube creator account would be the same as my personal Gmail/calendar/whatever. And don't put photos in the cloud at all unless it's e2ee. Chat/IM and email in the same place would make sense cause they're related things, except nobody uses Google's chat products. It's nice how iPhones do the neat AI photo search and montages all client-side, with my Mac backing things up. They're really catering to the less common use case there.
hot_gril 4y ago
That was a server-side scan IIRC.