News for hackers. Stuff that matters.
Re:Apple’s Mistake by simonh on Monday August 09, 2021 @05:13PM (#28122377)
> If the NCMEC searches by providers are being done as a result of government coercion then the fourth amendment requires there be a search warrant. Since there isn't one, these searches would all be unlawful if there was coercion.

Not a US citizen, so I’m not familiar with this argument. As I understand it the government isn’t searching anything themselves so would the requirement for a search warrant apply?

I think what the US government is requiring is that if a service provider comes across CSAM they must report it. Since I don’t see why searching your own service would be anything to do with search warrants either, is it constitutional to make such a requirement for other reasons?

Finally even if Apple could avoid this requirement, which they seem to have largely been doing until now, was it viable for them to continue like that? Even without a legal mandate to actively search for CSAM, knowing there must be millions of unreported CSAM images on their service can’t have been a comfortable position to be in.

Re:Apple’s Mistake by nullc on Monday August 09, 2021 @05:52PM (#28122762)
If the government requires or otherwise coerces someone to perform the search, then the searching party is acting as an agent of the government and is equally subject to the fourth amendment. Similarly, the government can't create a privileged entity like NCMEC and allow it to search without a warrant and pretend it's not the government doing.

What is permitted is that if a private entity of their own free will and self interest searches and then finds something, the government can require them to make a report when they found something. Just as you say.

But the government cannot require them to search in the first place, not without extending the fourth amendment protection against search.

Apple can decide that the commercial value of reducing the risk that they're accused of helping perverts is greater to them than the commercial value of respecting the customers privacy. Indeed. But lets call that what it is, and not make excuses that they're forced to search: They're not. They are choosing to search.

Re:Apple’s Mistake by dpkonofa on Monday August 09, 2021 @06:28PM (#28123111)
Take your argument one step further - the government knows this and starts issuing warrants for exactly these situations. Now, Apple is in a position where they have to violate their user’s privacy and share content in order to comply with the search warrants. The new system allows them to comply with warrants without ever knowing or needing to know what the contents of users’ phones are and only in cases where it’s known that illegal content exists. Apple can’t divulge any other content from the users’ devices because it doesn’t have it or know what it is in the first place.
Re:Apple’s Mistake by nullc on Monday August 09, 2021 @06:44PM (#28123233)
A warrant must name the specific persons/places/things to be searched. A automatic dragnet search isn't required with a warrant.

> it’s known that illegal content exists

A point of clarification: The system divulges the encryption keys to content when the content's "perceptual hash" matches one in the database the specific user is being tested against. Apple claims that the hashes are provided by NCMEC "and other parties". It is already known that the NCMEC databases has at least some hits for non-illegal content. Who knows what these databases might contain in the future. There is certainly no structural requirement in the system that the content is illegal or some specific kind of illegal.

For users in Thailand the apple database could just as well be full of hashes of cartoons insulting to the monarch (which are illegal there, as I understand it) and no one would be able to tell, at least not before apple users started being rounded up and summarily executed.

Re:Apple’s Mistake by dpkonofa on Monday August 09, 2021 @06:53PM (#28123311)
Yes but the criteria for a warrant can be nothing more than reasonable suspicion. So a warrant could be issued for access to someone’s entire device regardless of whether objectionable content exists on it or not. Theoretically, a government could issue a warrant for every single person’s phone and get what they want. This prevents anything even close to that from happening because users aren’t required to provide the keys and Apple won’t have them unless that content matches what’s on the list.

On your second point, yes… that’s a very real possibility and one that I’m sure Apple has already considered and has responded to.

Re:Apple’s Mistake by bigiain on Monday August 09, 2021 @09:01PM (#28124161)
> Theoretically, a government could issue a warrant for every single person’s phone and get what they want.

For that you'd need a sham court full of rubber stamping judges handing out bogus search warrants for every single questionable and illegal request that comes to them. That seems a stretch of the imagination? What judge would to _that?_

We could call that the FISA Court, right?

Re:Apple’s Mistake by bostik on Tuesday August 10, 2021 @03:32AM (#28126076)
No, you need just one: "every phone connected to at least two of these N base stations over this 48-hour window".

Which is quite a modern take on a historically reviled phenomenon, so you should call them for what they are: general warrants.

Re:Apple’s Mistake by dpkonofa on Monday August 09, 2021 @11:31PM (#28124895)
Glad I’m not the only one.
Re:Apple’s Mistake by heavyset_go on Monday August 09, 2021 @06:04PM (#28122891)
> Not a US citizen, so I’m not familiar with this argument. As I understand it the government isn’t searching anything themselves so would the requirement for a search warrant apply?

There's a difference between cops paying someone to break into a suspect's house to steal evidence without a warrant, and a 3rd party that, while doing business, comes across material that might be criminal evidence.

The former case, in the US, falls under the doctrine of the "fruit of the poisonous tree"[1]. Evidence collected illicitly won't be allowed in court, and any evidence or argument based on the tainted evidence can be thrown out, as well.

I think the line is blurred with the system in the OP, where it seems like it kind of fits the latter case. It's fuzzy to me when parties are working in tandem with law enforcement, even going as far as running law enforcement's own systems voluntarily, or collecting or giving up information without a warrant when simply asked. To me, that seems a lot more like former case, where the government persuades someone to collect evidence on their behalf without warrants or subpoenas.

[1] https://en.wikipedia.org/wiki/Fruit_of_the_poisonous_tree

Re:Apple’s Mistake by nullc on Monday August 09, 2021 @06:12PM (#28122969)
> voluntarily

In the US, that is currently where we've drawn the line.

They can cooperate, but it has to be voluntarily and the private party can't be government-by-another-name (e.g. not NCMEC which has a special legislative permission to handle child porn and is overwhelmingly funded by the government), but an actual private party.

Re:Apple’s Mistake by alfiedotwtf on Monday August 09, 2021 @07:00PM (#28123375)
Hasn't this already been tested in a US court? I can't remember what it was called, but since you're giving away your privacy to a third party, you've given up right for privacy period.
Re:Apple’s Mistake by schoen on Monday August 09, 2021 @08:00PM (#28123793)
Re:Apple’s Mistake by alfiedotwtf on Monday August 09, 2021 @08:59PM (#28124151)
Thank you. Third-party doctrine was what I was thinking of. So I'm guessing putting things in your phone will soon be seen as crossing into third-part territory if it hasn't already.
Re:Apple’s Mistake by nullc on Monday August 09, 2021 @09:04PM (#28124175)
It's not hard to imagine that this kind of automated scanning might be used as an argument for that: "Clearly you had no expectation of privacy for information on your phone..."
Re:Apple’s Mistake by alfiedotwtf on Monday August 09, 2021 @10:44PM (#28124690)
Bingo. If you chose devices that aren't open, you're chosing to give away your freedoms. I makes the jump to LineageOS earlier this year because I could see the signs that Apple were getting to comfortable with government. Now, I've got the confirmation I was right in my hunch