14 ms·
Apple defeats liability for not scanning iCloud for CSAM
- wbl 3mo agoIANAL but I thought the whole reason scanning worked was it wasn't required so there weren't fourth amendment issues.
- m3kw9 3mo agoIf these judges are so righteous, they should go further and mandate the OS to do mandatory scanning of personal hd.
- dilap 3mo agoDon't worry, we'll get there soon enough.
- stronglikedan 3mo agoIt's still a shade of gray to me. If I offered some homegrown cloud storage to my friends, and one of them uploaded CSAM to it, you can bet your ass that I would be arrested for it.
- polski-g 3mo agoDoes Sundar get arrested if someone uploaded CSAM to GDrive?
- izacus 3mo agoNo, because Google will report it to the law enforcement.
- rootusrootus 3mo agoThe law has exceptions for electronic service providers who report what they find on their storage. If you are operating a service for friends at no charge with no business plan you probably will have to work a bit harder to avail yourself of that exception. Might be best to charge a nominal fee and at least pretend to be doing it as a service provider.
- jobs_throwaway 3mo agoA win for privacy and freedom
- hosteur 3mo agoIndeed. And a rare one at that.
- amazingamazing 3mo agoIt is crazy people think apple isnt on the side of privacy. Are they perfect? Not even close, but compared to the rest of big tech theyre simply on another level. Apple could easily not do this stuff and it may even be easier to not.
- cryo32 3mo agoIndeed. But they are until they are actually defeated. I would rather plan for failure. We are in a global climate where court rulings can be ignored.
- avidiax 3mo ago> It is crazy people think apple isnt on the side of privacy. > It also ensured pressure from governments and plaintiffs, including CSAM victims, who preferred Apple’s more interventionist approaches, which Apple had voluntarily demonstrated it was willing to do. I feel that Apple open pandora's box with the client-side scanning. It proved that it was technically feasible, and was "privacy preserving". I use scare quotes there because I don't think that political or religious dissidents would find that the same or similar technology used to discover and persecute them is "privacy preserving". And that's really the problem with Apple here. They provided a model for scanning for any kind of message or material while purportedly maintaining privacy.
- mmmlinux 3mo agoIs it different than telling your therapist something in confidence and then finding police waiting for you in the lobby.
- arcticbull 3mo agoYes, in the sense that you have a legal doctor-patient privilege that binds what they can share with whom. There's not really an Apple cloud user privilege. No, in the sense that your therapist is still required to report you to the police in various situations where you pose an immediate threat to yourself or others, etc.
- i3ima 3mo agothe judge is indeed wise
- JSR_FDED 3mo agoThe judge called the outcome disturbing, as it leaves victimized children as "collateral damage" of privacy protections. As sad as this is, end to end encryption means no CSAM scanning. As an alternative Apple previously tried to do scanning on the phones locally but caught hell for that too. This is one of those unfortunate tradeoffs but I see no alternative to privacy taking priority.
- al_borland 3mo agoChildren are often used as a weapon to erode freedoms, like privacy and speech. Those pushing it rarely actually care about the children.
- layer8 3mo agoWhile I’m decidedly pro-encryption, I don’t like this argument. If something is the right thing, it would still be the right thing when promoted for the wrong reasons, and if it’s the wrong thing, it’s still the wrong thing even when at present nobody has ulterior motives. When arguing against surveillance, the arguments should be on its merits, not on whether the current proponents happen to have ulterior motives.
- al_borland 3mo agoCalling out the ulterior motives can help clear the deck to focus on what is right or wrong, without as much emotional manipulation in the picture.
- layer8 3mo agoOne problem with that is that it’s difficult to prove motives. So you’re on shaky and disputable ground. It’s much better to point out how the proposed mechanisms are prone to be misused, which is independent of current motives. Get rid of the shaky ground. Saying “these are disingenuous people proposing this” is exactly an attempt at emotional manipulation, in the sense of an ad hominem fallacy.
- 3mo ago
- twuopf 3mo agoI know creating a throwaway to hide your name for an opinion is a bad manner, but this one is one I really don’t want linked back to me The VAST majority of “CSAM” is consensually created and exchanged by teens. Their future selves and their parents form this pressure group attacking everyone’s liberty and privacy to try to undo the downsides of choices they made themselves with full knowledge of what could happen. The criminal and disgusting tail end of this type of material deserves the worst of consequences for the perpetrators and all the support in the world for the victims, but these are mostly - you guessed it - poor and unprivileged children from far away places and they certainly can’t put this much pressure on apple
- alistairSH 3mo agoDo you have a citation for that? Sounds plausible, but I'm not sure I've ever seen it stated that way in any of the related media reports on CSAM efforts.
- mschuster91 3mo agoIn Germany, the rise in "youth porn" material has been attributed to such kinds of cases where youth send intimate pictures to each other [1]. Our legal systems are not built to deal with that mess, and it may hang around your neck for the rest of your life. Unfortunately, the law is very explicit, leaving barely any avenue for the courts to drag us out of the mess, and politicians - even if they are actually interested in the topic in the first place - won't touch that area with a ten foot pole for fear of getting blamed a pedophile themselves. [1] https://www.n-tv.de/panorama/KI-treibt-Jugendporno-Fallzahlen-auf-Rekordhoehe-id31105930.html https://www.n-tv.de/panorama/KI-treibt-Jugendporno-Fallzahle...
- alistairSH 3mo agoWe absolutely have the same problem here in the US. There have been a few (small number) of cases that hit the national or regional news where teens were sharing nudes of classmates, etc. I'm questioning the parent post's contention that the "vast majority" of CSAM falls into this bucket.
- majorchord 3mo agoIMO "end-to-end encryption" simply isn't possible when the application is run by the same company as the servers the data sits on, is closed source, and can at any time, see the decrypted contents of data it downloads from their servers and do whatever they want with it. Same issue with Proton, MEGA, and any other e2ee app... it's only useful when the company decides not to mess with the data it could always decrypt locally. Also why people are hesitant to use javascript-based e2ee solutions where the site owner can modify the code at will to do what they want.
- megous 3mo agoThere's no issue with mega. There are third party apps and as long as you don't login to mega.nz with their website you're fine. And they also have SDK you can use that they'll not be able to control/manipulate without your knowledge.
- kyralis 3mo agoThis is based on a faulty understanding of the underlying systems. The risk with this sort of E2E encryption is not that the service provider pinky promises not to decrypt what they have, it's that they promise they will not insert a new key into your circle of trust to subsequently start decrypting things.
- IshKebab 3mo agoI think you've imagined this faulty understanding. There are many mechanisms by which Apple could actually decrypt the data despite pinky promises not to. You listed one. There are others.
- johnsmith1840 3mo agoYou're suggesting they purposely put a backdoor into all their custom methods? Why? From a liability standpoint that implies a security breach could result in massive loss of customer data and if it did occur would destroy their privacy image to their customers. I agree with the point that what you actually trust is the company to not insert maliscous code or keys into your protected path but modern systems actually contain ways to truly lock out the company itself from seeing your data. Security wise it's amazing. If a company's admin cannot take your data it's excedingly hard for a hacker to do so.
- St0n3d 3mo ago“Apple created its own proprietary alternative, NeuralHash, which apparently wasn’t as good. So Apple U-turned on its efforts to scan for CSAM in its cloud storage. Instead, Apple implemented end-to-end encryption for iCloud files.” Wasn’t Apple’s design to explicitly NOT scan in its cloud storage, but look at the file on-device at the moment you wish to upload it to iCloud? This method would make it compatible with Advanced Data Protection; so ADP could have always been in the pipeline rather than Apple u-turning. In fact, NeuralHash may have been proposed because Apple wanted to introduce ADP and saw a potential problem here/get concerns from government agencies about it and saw this as a means to an end(-to-end). The system was designed pretty elegantly and offers far better privacy protections - including guardrails - than what Microsoft and Google do, but the communication from Apple about it was absolutely horrible and generated enormous backlash. (Not saying I agreed with implementing it, just saying the design was infinitely better than competitors.)
- kyralis 3mo agoAlso, Apple's E2E iCloud encryption vastly predated the NeuralHash efforts.
- deleted 3mo ago[deleted]
- EmbarrassedHelp 3mo agoA mandatory client side scanning system with an opaque database filled with unverifiable entries would render many of the protections provided by ADP meaningless. Its was insane that Apple was even considering such an idea in the first place.
- drnick1 3mo agoI simply don't trust services such as iCloud. The legal landscape is too volatile, and Apple's own "terms and conditions" are also subject to constant change. As far as I can tell, most people don't need cloud backups, and iCloud mostly shows up as an annoyance designed to extract more money from customers. In fact, most people probably don't know that Apple and Google vacuum up their files the moment they are created, for their own good, of course.
- slashdave 3mo ago> most people don't need cloud backups What world do you live in?
- drnick1 3mo agoThe world where the operating system on my phone (GrapheneOS) isn't conspiring against me or uploading my files to someone else's computer.
- slashdave 3mo agoThat must also be the world where more than a tiny number of people are using GrapheneOS
- kowbell 3mo agoIs your phone also made of indestructible materials so it can't break, and magnetically linked to your person so it can't be stolen? Backups exist so you don't lose precious photos/data if you lose the device. Most People™ do not have the technical knowledge to set up a self-owned backup system, and/or will not realize how badly their future selves will wish they had backups if the setup friction for a self-owned solution is too high to conveniently do it right this second.
- mannanj 3mo agoI think we are closing that gap with AI coding tools. A growing number of people people today can figure out how to run Fable in a co work session, or codex, and that can indeed set up the self-owned backup system for you along with an alternative trustable cloud backup thats not Apple or Google.
- djoldman 3mo agoI am not a lawyer. There is something ironic about US laws that attempt to prevent crime A by outlawing action B. For example: * A: physical sexual abuse of children. B: possession or distribution of CSAM * A: drug trafficking or tax evasion. B: structured cash withdrawals The irony is that the more B is prevented, the less A can be detected and the less B can be used as evidence of A. It's my understanding that conviction of CSAM-related crimes do not require any physical act to have ever occurred to any real person: one can be convicted of CSAM-related crimes related to paintings/drawings/created_art of fictional people. It's my understanding that one can be convicted of structured withdrawals that are not driven by, linked to, or in any way related to anything nefarious.
- joshred 3mo agoI don't think these are the same. Outlawing CSAM gives law enforcement the ability to shutdown markets and prevent commercial distribution of CSAM. Sexually abusing children is heinous, but sexually abusing children for financial gain is even worse.
- carljungslabtek 3mo agoThere are even people involved in commercial distribution of it that claim to not even be interested in children, just in profit or even allegedly “for a sense of community” (someone actually said this after getting caught, he was in his 20s but I can’t remember his name — he might have been one of the red room guys). On top of that, while there are different types of child abusers, the worst ones almost invariantly collect CSAM to the point of hoarding. So it really isn’t that bad of a proxy. The root comment is implying that legalizing or decriminalizing csam would somehow help with prosecution of child abuse? I’m kind of speechless. Csam IS child abuse. The fact that there are consumers encourages producers to, well, produce!
- deleted 3mo ago[deleted]
- IncreasePosts 3mo ago
- quaddoggy 3mo agoAh, the CSAM saga. Very poorly handled by Apple. Suspect it may have taken Hair Force One off the shortlist of CEO succession.
- economistbob 3mo agoSeems like the kids miss their chance at justice because of section 230 allowing platforms the freedom to remove whatever they want but not be responsible for what they keep or amplify. That is the problem with 230. Censorship is permitted and punishing the censor isn't. Twitter and Tiktok are literally microblog platforms that get away with removing good stuff and leaving evil because they "are not a publisher" while the algorithm literally publishes a chosen set of articles to people. Facebook can remove religious freedom material and leave human trafficking groups. Section 230 gives the publishers the cake and the edict too.
- junon 3mo agoYou're conflating "what's illegal" with "what a private entity doesn't want". I don't like it any more than you do, but the first is very clear, the second is a bit harder to "solve".
- deleted 3mo ago[deleted]
- deleted 3mo ago[deleted]
- inigyou 3mo agoSection 230 doesn't provide as much immunity as people think. A platform can still be liable for the choice to amplify something.
- ryanisnan 3mo agoAs the creator of mediaden.ca[1] I’ve thought about this. Client side scanning is maybe marginally better than server side scanning, but both paths lead to privacy rot. Governments need to catch criminals, but they shouldn’t do it at everyone else’s expense. 1. https://mediaden.ca https://mediaden.ca
- kmeisthax 3mo agosigh Once again, someone (in this case, the judge of this case) asks if we can meet in the middle on whether or not private communications are actually private. To be clear: this is not a limitation of nerds' imagination. This is a limitation of physics. A person is either party to a communication (and thus can decrypt it) or is not (and thus cannot). If you demand Apple scan encrypted photos for CSAM, what you are demanding is that Apple be party to every communication done with an iPhone. There is no middle ground on encryption, there will never be a middle ground on encryption, and I will hold this truth on my deathbed. There is no "encrypted but crackable" - if the CIA can crack it at all, we're only a few years away from some kid's gaming rig doing the same thing. There is no "secure golden key" - if there was, you could buy it in the same section of Amazon that sells copies of the TSA master key that opens all luggage locks. Personally, the next time a government demands decryption keys, I think Apple should just set all iCloud photo libraries in that country to public and say "Sorry, your politicians made private photos illegal, take it up with them". Obviously, telegraph this far in advance and give users time to actually delete their cloud-hosted photos first. But definitely do not pretend like you can keep a secret with a government bureaucracy of hundreds of thousands of people. But then again, Apple also capitulated (good meaning) to the EU on third-party app distribution, so Apple has a lot less of a spine than they let on. At least Google actually stayed out of China.
- PhotoCore 3mo ago[dead]
- giantg2 3mo agoMaybe my perception is off, but it seems like there's a huge push by the legislature and some people to do anything and everything to prevent CSAM, yet almost nothing seems to be done to prevent CSA. For CSAM, there's all sorts of monitoring, scanning, identify capturing, etc. But it's all after abuse has taken place, and it seems that many of the people actually arrested are arrested for CSAM and not CSA. This has even extended to fictional CSAM such as AI generated stories and pictures. As an aside, if that gets extended to political speech or other non-CSAM materials that are determined to be undesirable, that's a big concern. I can imagine that a conservative state could pass a law banning all porn because they claim it could encourage illegal activities such as prostitution, rape, or CSA. On the CSA side, you rarely hear about arrests (they happen but less than CSAM). There doesn't seem to be any real push for educating and protecting kids before it happens. Ironically, the groups doing the most to educate and implement protective strategies are the ones who have been involved in abuse scandals in the past (Churches, Scouts, etc). Even then, a lot of it is just getting clearances, which doesnt prevent people who where not caught or were first timers. Offenders get put on a list/map. This is sort of a half approach. If they are still a threat, they shouldn't be released. Yet if you comb the list and see some of the results, they don't all seem to fit with CSA. I personally know of 1 who took a leak across from a playground at 2am walking home from the bars and was put on the sex offender registry because it was within 500'. It seems like these laws are more about peddling to the publicist and lawmakers fantasy of incrementally extreme punishment rather than taking a appropriate, data driven, and level-headed approach that actually protects kids. Otherwise they will just keep pushing ham-fisted low-hanging "fixes" like required scanning and IDs to access the internet.
- twothreeone 3mo agoI think it's similar with other liability issues, e.g., when a company happens to "lose" customer data through a breach. They will be on the hook for not having certain audits and certifications at regular intervals. Practically never will anyone be feeling any pain due to absolute disregard for basic common sense precautions to prevent issues in the first place. So usually, the pattern is that issues that can be outsourced to insurance will be handled by compliance departments - which don't care about the actual problems, just that the fallout from them is "managed" accordingly.
- 1saadcodes 3mo ago[dead]
- crest 3mo agoYou wouldn't hold the postal service accountable for delivering CSAM or a bank for offering storing it a lock box would you? So why should cloud storage services be different? Stop clutching your pearls and welcoming big brother over imagined threats while a real rapist sits in the oval office!
- kristopolous 3mo agoIf you're going to be committing a crime, why would you store it in a cloud service?
- VerifiedReports 3mo agoWhatever "CSAM" is...
- Unified-Mentor 3mo ago[dead]
- unselect5917 3mo agoA perfectly safe panopticon and freedom & privacy will always be at odds. Don't let a classic "think of the children" appeal to emotion short circuit your reasoning.
- KolibriFly 3mo agoA court should not quietly create a general duty to inspect everyone's private files because a provider could theoretically detect illegal content
- Schlagbohrer 3mo agoI have to point out that the united states absolutely does not, under any context, care about the health and wellbeing of children. If they did they would have good, easy to access free healthcare and support for families including parental leave, as well as a good public school system that served every single child adequately.