6 ms·

> Are iCloud Photos in their data centers not scanned? No outright statement confirming or denying this has ever made to my knowledge, but the implication, bas

> Are iCloud Photos in their data centers not scanned? No outright statement confirming or denying this has ever made to my knowledge, but the implication, based both on Apple's statements and the statement of stakeholders, is that this isn't currently the case. This might come as a surprise to some, because many companies scan for CSAM, but that's done voluntarily because the government can't force companies to scan for CSAM. This is because based on case law, companies forced to scan for CSAM would be considered deputized and thus subsequently it would be a breach of the 4th amendments safeguards against "unreasonable search and seizure". The best the government can do is to force companies to report "apparent violations" of CSAM laws, this seems like a distinction without a difference, but the difference is between required to actively search for it (and thus becoming deputized) v. reporting when you come across it. Even then, the reporting requirement is constructed in such a way as to avoid any possible 4th amendment issues. Companies aren't required to report it to the DOJ, but rather to the NCMEC. The NCMEC is a semi-government organization, autonomous from the DOJ, albeit almost wholly funded by the DOJ, and they are the ones that subsequently report CSAM violations to the DOJ. The NCMEC is also the organization that maintains the CSAM database and provides the hashes that companies, who voluntarily scan for CSAM, use. This construction has proven to be pretty solid against 4th amendment concerns, as courts have historically found that this separation between companies and the DOJ and the fact that only confirmed CSAM making its way to the DOJ after review by the NCMEC, creates enough of a distance between the DOJ and the act of searching through a person's data, that there aren't any 4th amendment concerns. The Congressional Research Service did a write up on this last year for the ones that are interested in it[0]. Circling back to Apple, as it stands there's nothing indicating that they already scan for CSAM server-side and most comments both by Apple and child safety organizations seem to imply that this in fact is currently not happening. Apple's main concerns however, as stated in the letter by Apple, echo the same concerns by security experts back when this was being discussed. Namely that it creates a target for malicious actors, that it is technically not feasible to create a system that can never be reconfigured to scan for non-CSAM material and that governments could pressure/regulate it to reconfigure it for other materials as well (and place a gag order on them, prohibiting them to inform users of this). At the time, some of these arguments were brushed off as slippery slope FUD, and then the UK started considering something that would defy the limits of even the most cynical security researcher's nightmare, namely a de facto ban on security updates if it just so happens that the UK's intelligence services and law enforcement services are currently exploiting the security flaw that the update aims to patch. Which is what Apple references in their response. 0: https://crsreports.congress.gov/product/pdf/LSB/LSB10713 https://crsreports.congress.gov/product/pdf/LSB/LSB10713

Shank 3y ago
To add a bit more color, 18 U.S. Code § 2258A specifically states: > Nothing in this section shall be construed to require a provider to— > (1) monitor any user, subscriber, or customer of that provider; > (2) monitor the content of any communication of any person described in paragraph (1); or > (3) affirmatively search, screen, or scan for facts or circumstances described in sections (a) and (b). The core of 18 U.S. Code § 2258A - Reporting requirements of providers is available at https://www.law.cornell.edu/uscode/text/18/2258A https://www.law.cornell.edu/uscode/text/18/2258A.
- turquoisevar 3y ago
  I was looking for that! Great addition to provide more context.
  - salawat 3y ago
    Don't forget this part: >(e) Failure To Report.—A provider that knowingly and willfully fails to make a report required under subsection (a)(1) shall be fined— (1) in the case of an initial knowing and willful failure to make a report, not more than $150,000; and (2) in the case of any second or subsequent knowing and willful failure to make a report, not more than $300,000. I find these clauses at odds with one another in that the Failure to Report clause created a tangible duty upon the provider, which, were I a judge, would satisfy me that rhe provider was, in fact, deputized. Does nobody actually read the legislation that is passed and realize that oops, I just passed am unconstitutional law. That they include the construed... clause just solidifies for me that the legislators in question were trying to pull a fast one.
    - turquoisevar 3y ago
      It’s because they wanted their cake and eat it too, get as close as possible to the 4th amendment without crossing the line. Put simply, if they have knowledge of it they have a duty to report, but they can’t be compelled to try and find out. In theory this means that if they happen to stumble upon it or are being alerted to it by a third party (e.g. user report) then they have to report it, in practice many voluntarily monitor it, maybe because they want to avoid having to litigate that they didn’t have knowledge of it or maybe because it’s good PR or maybe because they care for the case. I think in most cases it’s all of the above in one degree or another.

Shank 3y ago

To add a bit more color, 18 U.S. Code § 2258A specifically states: > Nothing in this section shall be construed to require a provider to— > (1) monitor any user, subscriber, or customer of that provider; > (2) monitor the content of any communication of any person described in paragraph (1); or > (3) affirmatively search, screen, or scan for facts or circumstances described in sections (a) and (b). The core of 18 U.S. Code § 2258A - Reporting requirements of providers is available at https://www.law.cornell.edu/uscode/text/18/2258A https://www.law.cornell.edu/uscode/text/18/2258A.

turquoisevar 3y ago
I was looking for that! Great addition to provide more context.
- salawat 3y ago
  Don't forget this part: >(e) Failure To Report.—A provider that knowingly and willfully fails to make a report required under subsection (a)(1) shall be fined— (1) in the case of an initial knowing and willful failure to make a report, not more than $150,000; and (2) in the case of any second or subsequent knowing and willful failure to make a report, not more than $300,000. I find these clauses at odds with one another in that the Failure to Report clause created a tangible duty upon the provider, which, were I a judge, would satisfy me that rhe provider was, in fact, deputized. Does nobody actually read the legislation that is passed and realize that oops, I just passed am unconstitutional law. That they include the construed... clause just solidifies for me that the legislators in question were trying to pull a fast one.
  - turquoisevar 3y ago
    It’s because they wanted their cake and eat it too, get as close as possible to the 4th amendment without crossing the line. Put simply, if they have knowledge of it they have a duty to report, but they can’t be compelled to try and find out. In theory this means that if they happen to stumble upon it or are being alerted to it by a third party (e.g. user report) then they have to report it, in practice many voluntarily monitor it, maybe because they want to avoid having to litigate that they didn’t have knowledge of it or maybe because it’s good PR or maybe because they care for the case. I think in most cases it’s all of the above in one degree or another.