> They are using a library of human verified images to compare the hashes

I didn't get that from the article, could you point to a source on this?

Images are submitted by over 1400 organizations[0] like the FBI and NCMEC, although the inner-workings of the database aren’t public and I can’t find a source or confirmation of every image actually being human-verified. The closest is how the "Child Victim Identification Program" helps identify victims in these images.

0: https://www.missingkids.org/theissues/csam#:~:text=Electroni... (ctrl-f "1,400")

Of all of the discussion, my brain has only keyed in on the child porn aspect. It just now clicked that if a missing kid is in a photo (even if not porn), it could help ID the missing kid. Some runaway at the age of 13 gets photographed in a group of other kids just doing teenager things.

So even if not running hashes against known porn, it could still be doing facial recognition. Wonder what kind of implications that would have for people in witness protection or battered spouses and other legitimately "disappeared" people.

Think of the children will erode everything. It is magic.

Appeal to emotion: https://en.wikipedia.org/wiki/Appeal_to_emotion

Directly said in the article:

“Users’ photos, converted into a string of numbers through a process known as “hashing”, will be compared with those on a database of known images of child sexual abuse.”

> The system has been trained on 200,000 sex abuse images collected by the US non-profit National Center for Missing and Exploited Children.

Also from the article.

‘Trained’ being important.

It's still bad. I used to scrape pictures from many legal pornography sites. I still have hundreds of thousands of pictures. Since many are user uploaded, I imagine a small number could be real CP.

Thank God, I don't use Apple.

(I should probably delete them, since I've basically never used them... although they could be useful for one of those end-of-world Raspberry Pi builds: https://back7.co/home/raspberry-pi-quick-kit-one Edit: the non-bad ones, in case this gets misconstrued)

Edit: I've deleted my archive.

Yeah, might want to consider deleting them. That could turn into a nightmare.

If you think there's a reasonable chance that you have CP on your computer why wouldn't you delete all the stuff? This is not complicated.

cat /dev/urandom and it also has CP, oh noes! quick delete everything.

Hoarding porn is kind of useless nowadays, especially without any kind of selection and categorization, but maybe someone does it because it's their hobby (or obsession), who knows.

Also if a lot of people has a bunch of porn images scraped from forums it's quite possible that eventually some of that might become illegal as the laws change here or there around the world. Should they proactively delete everything? Sure, they could. To be safe.

But this kind of safety is absolutely the bad kind on the long term. (Though of course it's possible to advocate for reform while not storing content with uncertain legality.)

Dude, this is all great in theory but in a court of law you'll get completely horsefucked if you have child porn on your hard drive. The judge and jury won't care about /dev/random or a fall to reform

You would think that in our "great" and "fair" legal system simply scrapping a legal site would not be enough to ruin your life. Especially if no harm was done and no intention of harm was there.

I’ve never once wanted GIF support on HN comments until this moment. Good god man what is wrong with you

> Since many are user uploaded, I imagine a small number must be real CP.

I mean, that is actually illegal. The problem here is the possession of child pornography.

I didn't have "a shit ton". I said that out of ~x00000 images, some might be bad.

But, yeah, I've deleted them now.

Good I'm glad, I was only harsh because I don't want to see an innocent programmer tossed in jail because of one mistake. xoxo

I bet(or know...) the people who verify those images don't get paid anywhere near enough.

I believe that US federal agents tasked with investigating these kinds of crimes typically only do so for a limited time.

The conventional wisdom for people integrating PhotoDNA is that false positives are vanishingly rare. If you run it against your data and you get a hit then you should call the FBI.

It would be better if the false positive rate was known to be nonzero.

And what, in this context, is "your data?" Is a photo on an iPhone Apple's data?

I'd argue that the thing you should do if you get a hit is to delete your data, unless you want to spend enormous amounts of time and money defending yourself from prosecution by people who believe that false positives are vanishingly rare.

I'm talking from the perspective of a service-owner who handles user-generated content. You typically set up PhotoDNA on two parts of your infrastructure. You scan client-side and refuse uploads to prevent the images from getting on your servers in the first place and then you scan on the backend to catch anything that slipped through. You do the first part so you don't have to call the FBI.

I really don't care about the semantics of data ownership. If Apple wants to scan photos you upload to iCloud so they don't run into a scandal years down the road that "iCloud is being used to distribute CP" then that's their call.

And to the letter of the law you can't just delete the data if you found CP that one of your customers uploaded without running afoul of mandatory reporting laws.

In the real world the system delete the data, deletes the associated user, bans the user and no human will do anything about it. Most likely there isn't even a report made to a human it just goes under ToS violation or something so no one inside the companies aks questions.

No FBI is called. Imagine the financial damage this would do if specialist come over and try to collect evidence and the company is forced to cooperated and work for them, for free ofc. Only the big tech does this. They have whole teams for this and automated system and what not because surely the FBI wont walk into googled data center ever to collect evidence. But all the smaller companies they cant afford to do this and the detection system is actually to protect them form going bankrupt because they accidentally stored some illegal data from a user.

>And to the letter of the law you can't just delete the data if you found CP that one of your customers uploaded without running afoul of mandatory reporting laws.

Yes such laws exist. So they use filter software from third parties. They intentionally offer some generic filter that includes "unwanted content" and doesn't specify what it is when it find something so the companies can wave away the liability as they have no way to know if the image was valuable evidence of a crime or just some LiveLeak gore. They can justify that no human watches it because that's to expensive.

Changing the size or file type of the image would easily change the hash.