Frankly, it's more of a problem for my data to be flagged after Google has it than it would be for it to never leave my device at all.

People have certainly run afoul of the law when the data Google has about them is misused.

>Innocent man, 23, sues Arizona police for $1.5million after being arrested for murder and jailed for six days when Google's GPS tracker wrongly placed him at the scene of the 2018 crime

https://www.dailymail.co.uk/news/article-7897319/Police-arre...

We are only talking about what happens when you try to send the data to the cloud, after all. Not about all the data on the device.

You are so close to understand the issue. When Google, or anyone else, is flagging it and sharing the result with, e.g., law enforcement you can have a problem. Apple will no just simply refuse to upload stuff that would be flagged in the cloud, it is flagging it already before upload on your device. And share the results with authorities. That for now they claim to only do so with stuff about to be uploaded is of minor concern, the tech is there to scan all the pictures on an iPhone now. No reason to believe it will stop with intended uploads, or pictures.

> Apple will no just simply refuse to upload stuff that would be flagged in the cloud, it is flagging it already before upload on your device. And share the results with authorities.

None of this is true. A sibling comment describes the process:

>1. Only if you're uploading files are the files matched. 2. Only if the matches are very close are they considered matches. 3. Only if you have multiple very close matches is Apple able to decrypt the low-res versions of the images themselves. 4. Only if a human reviewer discovers any of the decrypted low-res images to be illegal content is any of your information shared with anyone else.

https://news.ycombinator.com/item?id=28120598

Really? Apple and Google have been able to scan content on your phone as long as they have sold phones. They control the OS, therefore they have access to the content. The ability has always been there. The only difference is that Apple has now openly announced what they are going to do and how. If governments wanted to pressure Apple (or Google) to scan content they could have done that anytime in the last few years. If Apple and Google resisted that before, why is now different?

From a legal perspective, there is a significant chasm between "you are hereby ordered to develop a whole new surveillance feature for devices you build" and "you are hereby ordered to add these new (potentially unrelated to CSAM) signatures to your existing surveillance network".

Under what legal basis are certain corporations immune to government demands while others are not?

Google does reporting on how many National Security Letters requesting information about it's users that it responds to annually.

Why doesn't it just ignore them?

> Google does reporting on how many National Security Letters requesting information about it's users that it responds to annually.

So does Apple[1]. Apple gave data on over 31,000 users/accounts based on National Security Letters in the first half of 2020 alone[1].

> Why doesn't it just ignore them?

In the first half of 2020, Apple provided data to the US government (non-FISA or NSL) about 9,000 times, and responded to requests for data with the data about ~85% of the time, and 92% in cases of "emergencies"[1].

[1] https://www.apple.com/legal/transparency/us.html

I don't understand your question. Google, Apple, Facebook et al comply with their legal obligations.

Apple does not have a legal obligation to install spyware on your phone (at least not in the US, not yet).

I think so too but from a different angle. It sounds like the federal government is strong arming Apple to spy on their users. Apple would rather use on-device hashing to preserve some amount of privacy rather than give unfettered access to the feds to their cloud.

On the other hand, Google can run arbitrary queries over your data (published to their cloud) while Apple uses the same algorithm and hash database for everyone (which probably will get reverse engineered and audited by next BlackHat).

What makes you think that Apple will use the same database for everyone?

You can't realistically reverse engineer a hash to source image.

1. Previous submission (http://www.hackerfactor.com/blog/) claims that PhotoDNA is reversible to 26x26 grayscale

2. What’s more important is you can reverse engineer algorithm that’s used locally to compare these hashes. Unlike with cloud-based searches other providers run, this puts significant limitations to what Apple or LEA can do on your phone. E.g. they can’t extract strings from PDF or grep through image metadata or request all images of certain users without knowing what these images would depict in advance. The frequency of hash database updates even if opaque will still provide more insight into what is being searched for compared to current status quo where public has zero insights because all search / aggregation queries are run on the server.

My understanding is they only scan for content if it's being uploaded to iCloud. Scanning on the phone, yes, but only if the image is to be sent over the network.

And they seem to be doing that because they both 1) want to enable e2e encryption for iCloud images, soonish, and 2) don't want to become the world's most popular child porn storage and sharing platform.

I get the arguments for why the fix for #2 is too dangerous to be worth it, but also get why they'd be inclined to choose it.

Apple can already find photos of my cat, of ice cream, and of the sky directly on my phone using AI