I've been briefed about it. Apple says explicitly that this is not the case. They mention that cropping, transforming, or even desaturating an image won't result in a hash that's so different from the matching one. The similarity will be high enough to detect the photo anyway. They don't seem eager to explain in detail how that actually works, though.
If you want to learn about the algorithm/hashes, you have to, among other things, sign an NDA about it, so it's likely that Apple, legally, cannot go into detail about how it actually works.
Microsoft has a page on it here if you're interested: https://www.microsoft.com/en-us/photodna
For obvious reasons, they don't go into a whole lot of detail.
I've learned a lot about how the process works from this blog post: https://hackerfactor.com/blog/index.php?/archives/929-One-Ba...
He gets a few facts about Apple's approach wrong, but it's an incredibly interesting read.
Thank you for pointing that out though. I had no idea.
If so, then I’ll immediately change my mind and join the protest. Device local scanning is equivalent to someone checking your personal possessions at your home.
From the overview:
> Apple’s method of detecting known CSAM is designed with user privacy in mind. Instead of scanning images in the cloud, the system performs on-device matching using a database of known CSAM image hashes provided by NCMEC and other child-safety organizations. Apple further transforms this database into an unreadable set of hashes, which is securely stored on users’ devices.
If iCloud is off, do they still do this? Your quote actually doesn’t contradict that, which is my main hangup. If you turn on iCloud, you forfeit certain expectations.
I’ll read through it carefully now.
EDIT: It was the very first sentence of the intro:
> CSAM Detection enables Apple to accurately identify and report iCloud users who store known Child Sexual Abuse Material (CSAM) in their iCloud Photos accounts.
I don’t get it. It’s their platform. Other image platforms do this matching. Old film shops used to do this matching. Why is this evil?
There’s also the fact that the “only scans local photos marked for upload to iCloud” is a technically thin barrier. A switch that could very easily and quietly be flipped in the future.
Do you have an objection even though it means that the content (in a form readable by anyone else) never leaves your device? Would it be preferable if Apple scanned files that were synced to iCloud, but no longer encrypted them in transit/at rest, or encrypted them in a way that they are able to decrypt?
I just don’t see the intrusion.
Firstly, you are syncing your photos to iCloud. It’s equivalent to developing your photos at an old timey film shop.
iCloud happens to have lots of security guarantees, much like the film shop.
But the moment you develop CP, all bets are off. I think most of us lead pampered, selfish lives. Perhaps this is a “think of the children” cry, and perhaps this has been used for many evils over time.
If Apple were to get their lists of hashes from China (a situation they’ve opened themselves up to in the future), then sure, that’s awful. Or if they were doing these checks and alerting law enforcement without iCloud sync, then that’s awful too.
But this doesn’t seem to be a slippery slope, yet. They are targeting a specific case: you uploading your photos, and your photos being of known child sexual abuse.
Yes, there are false positive photos in the database. Maybe there’s even a flower in there. But if you got flagged as a false positive, the moment law enforcement looks at your photos (which, remember, you’ve surrendered to iCloud), you sexually abusing a flower won’t cause any problems.
Or will it? Please, my mind is open. I’d love to change it.