They also could have had a legitimate claim to non-technical people (at the FBI/NSA/blah) that "you sure you want this? this system will be abused...someone could write a hash collision". The Gov't agency scoffed because they didn't believe it.

So Apple called them out on it by letting the market decide. They now have that evidence.

Never attribute to 4D chess what can be adequately explained by knee-jerk reaction.

This is an excellent and perceptive Hanlon corollary.

Never attribute credence to an argument because it has a name

Razors are inherently self-identifying as heuristics - not rules. So no need to add more disclaimers.

Never attribute credence to an argument because it was stated confidently

I don't really understand the argument that was thrown out by many people: "Attackers will frame people by planting hash collisions on their phones!"

So...

a) a bad actor is going to target someone, and have the resources to generate enough collisions that(b) look like CP, but aren't CP? but are close enough (c) to pass human review and cause an investigation so (d) they need the hash collisions to look like CP, but not be real CP? or ????

If a bad actor wants to frame someone, it's easy to do this today - hack their system or home network, open it to the internet, place the photos, call the FBI and report an anonymous tip, with the URL where it is hosted and open to the internet. Don't need hash collisions.

Hacking someone's iPhone (How do you get the photos on there without forensic logs that they were added?) or iCloud so that you can place hash collisions that look like crap and fail to pass the review doesn't make sense and leaves too much of a trail. Oh? And someone won't notice thousands of photos just added to their phone?

A bigger threat would be deepfake CP. When that becomes a reality, it will be a mess, because an attacker could theoretically generate an unlimited amount of it, and it will be extremely difficult to tell if it is authentic. Those hashes wouldn't be in the CSAM database, but if the attacker put them out on a server to be taken down, they would get added eventually and then show up in a scan elsewhere.

But I'd be pretty horrified (and definitely call my attorney, Apple, and local FBI field office) if thousands of CSAM images just showed up in my iPhone photo stream.

Edit: Downvotes are fine, and I completely understand other arguments against this, but this one has just not made sense to me...

This is a very simple attack to pull off; email someone with the colliding image embedded in the MIME document. Set height and width equal to zero or one pixel. Even if the user never actually sees it or marks it as spam, it's still on their device and in their email. For bonus points, spoof the "From" as from Apple. At the very least, they're getting SWATted.

If this were a reasonable vector, it'd already be an issue, at least if you use large email clients like Gmail, which already scan for CSAM.

Edit: Downvotes because?...

Downvotes because nerds love to construct a super super unlikely corner case to argue against something ;)

I'd call that out as totally unfair... if I haven't found myself doing that many times before hahaha.

We, the nerds, only have to be wrong once in order to allow immense harm to occur. Apple voluntarily put itself in that position.

Conversely, the governments of the world get to keep trying, over and over.

Because it IS already an issue.

For example when CIA/NSA tools leaked, one of them had precisely this purpose.

Those use a different perceptual hash that's intended to be kept secret.

It's significantly harder to develop collisions for an algorithm you cannot inspect or obtain the output of.

(well also, emailing actual CSAM is way easier and mostly just gets the sender reported)

Apple also uses a second, different perceptual hash that's intended to be kept secret, on server side.

Then why have a client side scanner in the first place?

You're exposing the hashes to the world, you're not able to E2E encrypt anything if you need to server side scan, which you probably do since trusting the client no matter what is generally bad in potentially adverserial situations, and you get all this negative press and loss of reputation and potentially pressure from governments around the world to use this for other ends. Cui Bono?

I think you have misunderstood the system.

The second scan applies only for those images which are flagged as positive, which are then accessible by Apple. This is applied to detect adversarial hashes. The rest of the images stays encrypted. So, indeed on-device scanning is the only way to enable at least partial E2EE with CSAM detection.

Yes, this was PR failure Apple. They rushed the announcement because of the leaks, and secondly they thought that people will understant the system when they did not. There is too much misundersting. That scanning for example is built-in so deep into the iCloud pipeline, that one does not simply change the policy for scanning the whole phone.

>I think you have misunderstood the system.

On a technical level I think you're correct. As a holistic approach to the problem, I still disagree. This is too cute for its own good. The PR misunderstanding is a symptom of that.

>The second scan applies only for those images which are flagged as positive, which are then accessible by Apple.

In the end, Apples software is scanning all of the images, why is it any more privacy respecting to do it this way? I guess reasonable people can disagree on that, personally I wasn't fully aware of the cloud side scanning either, and I don't think the public was either. This is similar to Snowden's revelations, if you were paying attention you probably already knew a lot of that, but the incident made everyone aware of it in a very blunt way.

>The rest of the images stays encrypted

I think this is unclear, Apple can still decrypt those other images, how else could you view them in a browser?

This goes back to what Stratechery said about capability vs policy.

> I think this is unclear, Apple can still decrypt those other images, how else could you view them in a browser?

Obviously there is change coming to iCloud. Otherwise whole PSI protocol is pointless.

You might want to reconsider holding your breath for that. No they aren't doing E2E encryption, if/when they will, they will announce it. Until they announce something everything else is pure speculation.

At least we know that secrets never leak out.

Surely the sender is also likely to get reported if they email the image with the perceptual hash collision. Lots of companies run these scans. E.g. if you send the image via gmail it will most likely be scanned by Google.

Assuming the system works as Apple's described it, then this attack doesn't work. The image needs to be added to the Photos library and the Photos library needs to be syncing with iCloud. Images in email aren't scanned, and an image that's zero or one pixel can't even be clicked on to be added to the library.

And, to at least respond to two obvious counter-arguments I've looked into:

"But it's just one line of code to change it to scan images (that aren't uploaded to iCloud) (that are anywhere on the device)!" No, it isn't; if you read the technical documentation and the more technically-oriented interviews Apple's given on this, there isn't just one hash that needs to be matches, there are two hashes, one on the device and one on the server. (I think Apple did a very poor job of communicating this to a general audience; it certainly wouldn't have alleviated all the concerns, but if it was understand as "client-server scanning" rather than "client-only scanning" it might have at least changed the tenor of the conversation.) That doesn't mean they can't do a combination client-server scan on every single image or even file on the device, but it makes it both more difficult to do and more difficult to hide.

"But what if the system doesn't work as Apple's described it?" Well, if you don't trust Apple to some degree, all bets are off. They already do ML-based image analysis of all photos in your photo library regardless of iCloud status and they've literally demoed this on stage during iPhone keynotes, so if Apple was going to secretly give government access to on-device scanning, a different technology -- one that works (questionably well) on all images, not just already-learned ones -- is literally already there. The only way you "know" what Apple is doing with your data on or off device comes from a combination of what they tell you and what third-party security researchers discover.

That is a huge-huge difference if they do it secretly, or if they do it announced.

If they get caught doing secretly this in China that would be a big blow. But if they are doing openly and it is known that the government provides the hash, they can wash their hands.

How does this theoretical attack get them to save the attached image to iCloud?

I think there's an unspoken assumption that photos are only the first part of this scanning exercise. IMO, Apple will likely end up scanning all content you choose to put on their servers.

Tangentially, I think keeping their servers clear of illegal material is actually Apple's main motivation. This, in turn, supports claims made by nay-sayers that Apple could scan for other types of images/content in more repressive countries (but not necessarily report the people who did it). However, this assumption also contradicts arguments that Apple will start scanning for pictures of (e.g.) drugs, or weapons. Such images are not inherently illegal and therefore of no interest to Apple.

> Tangentially, I think keeping their servers clear of illegal material is actually Apple's main motivation

My guess about this whole debacle is that - with pressure from the government to scan their cloud storage - that this is the alternate scenario to avoid giving up (or being forced to) the "encryption" guarantees of their cloud. I'm not sure what technical process they have in place to "only decrypt with valid law enforcement requests" or allow account rescue, but it seems likely that not just any employee can view whatever they want, before or after this system.

Saying that I can maybe see a way the pressures are on this doesn't mean that I'm saying this is a good solution though. Clearly technically implementing this is opening a can of worms that can't really be closed again and makes a lot of other scenarios "closer".

Also, evidently, people are a lot more comfortable with the idea of them actively scanning stuff people store in the cloud than transmitting the information in a side channel so they don't even need to handle decrypted data without a hit.

> My guess about this whole debacle is that - with pressure from the government to scan their cloud storage - that this is the alternate scenario to avoid giving up (or being forced to) the "encryption" guarantees of their cloud.

This is exactly the case. https://www.eff.org/deeplinks/2019/12/senate-judiciary-commi...

> I'm not sure what technical process they have in place to "only decrypt with valid law enforcement requests" or allow account rescue, but it seems likely that not just any employee can view whatever they want, before or after this system.

They have master keys that can be used to decrypt almost everything you upload. They can be compelled to decrypt and turn over information on anyone. Another (unsourced) comment in this thread indicated they do so 30,000 times per year. The new encryption scheme will effectively stop this for photos, and no doubt other files in the future.

Apple's side will begin using shared key encryption, which will require ALL ~31 keys to decrypt the offending images.

The decryption keys are only generated on-device, and only from a hash that results from a CSAM match. The other photos, simply won't have the decryption keys generated, so they don't even exist.

As an interesting side note, this means that a person who surpasses the CSAM threshold will still only reveal the images that actually match the CSAM database. Every other image, including those that have CSAM unknown to authorities remain encrypted. This is hardly a big win for the big scary government. They now have far less ability to search for evidence of any other crimes. You could upload video of your bank robbery to iCloud, and as long as your personal device remains secure, nobody will know.

> IMO, Apple will likely end up scanning all content you choose to put on their servers.

Even if that was a goal (and I would argue they have a hard stance against it), this system as built is not usable for that.

While they can scan locally, every step of recording, thresholds, and subsequent automated/manual auditing is built to require content to be uploaded to iCloud Photos.

I agree that the current photo scanning system won't work for other types of files. Further, I don't think they really even need to scan text files except to see if it's actually a filetype that should be scanned. And they can already easily scan music and such, but have shown no interest in it from a legal standpoint. Video seems like a prime candidate for the next generation of this tech. And I very much think they will be able to do that before the decade is over.

iCloud is trivial to hack. Recall the massive leak of celebrity nudes a few years back. As long as iCloud is forced on users (you cannot apply security updates to an apple device without an Apple ID and an attached iCloud account) these attacks will be simple to do in mass, with very little risk to the perpetrators. Terrible security model, with a long history of spectacular and avoidable breaches which go totally unsolved.

Let’s ignore the fact that you just shifted the goalposts from “emailing a 1 pixel image SWATs them” to an extremely wide scope for a minute -

Even assuming that is true that iCloud is trivially “hackable” - and as I understand it, that was never clear how those leaks happened - how does uploading to iCloud help when it specifically needs to be uploaded from the users phone along with the scanning metadata.

In fact, isn’t apples proposed implementation here the _only_ cloud service that protects against your proposed attack - while other clouds scan stored data and can be triggered by your attack, Apple’s requires you to upload specifically from a registered phone on their account; data stored on-cloud is never scanned.

You can choose to use an iPhone. Most people will never be targeted. Hell you could use a phone with no security at all and odds are you’ll be safe. But if you have enemies or are a high profile target, apple has made you easy to destroy. iPhones themselves can be hacked with no click attacks and we know this because macron’s phone was one of many that was listed in the recent fiasco. Icloud can be hacked because legions of celebrities had their nudes published. If the device is not secure, even for the president of France, and iCloud is not secure for legions if celebrities, then people can and will be hit with this attack and have their lives permanently destroyed. Worse than having you sex photos leaked, worse than having all you calls and communications intercepted, you’ll become known as a pedo. You can’t undo that. To be sure, that probably won’t happen to most people, but political figures, those with enemies working in infosec, etc…. I want a secure phone, and iPhone no longer meets that need for me and many others. You can do you.

The described attack is completely unnecessary. Just send colliding images to people on WhatsApp. They go right into Photos, and then to iCloud if that’s enabled. There’s no reason most people would assume that this is what was happening if somebody sent them some slightly weird looking images.

The response to this is “yeah but then a human will review it and nothing will happen to the victim of the attack, because it’s just some slightly blurry ordinary images”. But it ignores to entirely likely harms that could result from that.

1) Law enforcement use it as the basis of getting a search warrant, but conveniently leave the bit about the alerts being false alarms off the warrant application.

2) The list of people who have had CSAM alerts is inevitably leaked to the public, and the victim has to spend the rest of their lives explaining to people like employers why Apple flagged them as possessing child sexual abuse material.

At the end of the day, all the gaslighting about “no potential for inadvertent harm” is bs, because it’s my device, so get lost. Go run your anti-privacy software somewhere else, imo.

As I understand it;

- Law enforcement doesn't get _anything_ unless it triggers a large number of images that match the perceptual hash

- It also needs to match a -private- perceptual hash, that isn't distributed to devices, and so we don't have a reliable way of generating collisions for or even knowing that collisions are generated

I mean this whole thing is bad enough on its own without having to artificially manufacture extremely specific scenarios and extrapolating from there to invent hysteric conclusions.

Well if you think a tech giant that’s partnered in a surveillance program with the NSA isn’t going to share anything they feel like with the government, then go ahead as use that as the basis of coming up with your own opinions.

But you’re right though, the possibility of the list being leaked and ruining countless innocent lives is the much more likely of the two scenarios I described.

> if you think a tech giant that’s partnered in a surveillance program with the NSA isn’t going to share anything they feel like with the government

In that case, nothing is stopping them from scanning everything already uploaded anyway, and nothing is stopping them pushing code to your device to scan it without telling you about it. Nothing is stopping them or the government from making these "lists" anyway.

I'm not saying you (or anyone) should trust Apple, but if you already don't - then this changes literally nothing.

By my own personal assessment it changes the way I view them, because this is the most overtly anti-user, anti-privacy thing they’ve ever done. Perhaps I should have never had any level of trust for them, but you live and learn I guess.

Feel free to respond to my point about the alert catalog inevitably being leaked and ruining lives. Or you could just have a go at gaslighting me a little more if you prefer.

Gaslighting? Your proposed scenario is:

- Send colliding images

- image gets uploaded to icloud automatically

- image _also_ collides with private hash <- completely unclear how this happens

- Only the colliding images are looked at by apple and are determined to be innocent

- user goes on a list (This is an imagined scenario)

- User is reported to law enforcement even though the images are innocent (This is an imagined scenario)

- Law enforcement uses this hypothetical report to file a warrant (This is an imagined scenario)

- Law enforcement uses the hypothetical warrant to extract images that are completely innocent, and somehow build a case around this

- The "List", which is entirely a hypothetical of yours, "leaks" (This is an imagined scenario)

Which also requires:

- Apple does not counter the meaning of "the list"

- Apple is not sued for vast quantities of money

I expect the first argument is that none of this matters as long as "the idea" is out there, the reputational damage is already done. Except if that's true, then none of this is necessary at all, just make the accusation.

So, sure, continue to thread the needle between "They are automatically sending all information to the government, so promises are meaningless" and "This new process, on top of them potentially sending all information to the government, somehow makes it worse".

I mean, this is all a million times more difficult and less likely than just, like, sending them CP in the first place. Or uploading it to their Gmail or any other cloud they use. Or just send a report that they have it to the police without actually doing anything.

That’s absolutely not an accurate representation of what I’ve said, or how this system works.

All it requires is somebody to send somebody else a colliding image.

This will send an event to Apple. There is nothing imaginary about that, it is exactly how the system works.

Now that Apple has this information, the only thing left is for it to be leaked or compromised in some way.

This is much simpler than the scenario you’ve described, because they require the attacker to first commit the crime of possessing CP. Its also possible to do without tipping off the victim in any way.

Apple, in case you didn’t know, is a company that had already been the source of a couple of the most notorious data breaches ever (and has somehow managed to so far avoid getting “sued for vast quantities of money” for them).

What you’re trying to do here is quintessential gaslighting.

Apple's proposed system does not scan all the pictures on the device, only images about to be uploaded to iCloud. A picture in an email would not be uploaded (whether visible or not).

Even if uploaded to iCloud (such as pictures sent via WhatsApp by default), and above the threshold, they would still be scanned by a second algorithm and subject to human review. So, your "very simple" attack fails on at least three counts.

I would expect the human review ("Swatting") to be transparent, unless it was actually CP or looked like CP, at which point the person would be taken for a ride... But this is a real threat with actual CP now.

And again, there is the whole fact that you received the email and there is a log that you received it.

"Human review" here means basically minimum wage person who's looking through a lot of abuse images on a daily basis & has significant fatigue. I view it more as a CYA thing than any meaningful protection mechanism.

Additionally, the images sent to review are significantly downscaled versions of the original & could easily be made to be ambiguous.

The most difficult challenge in this SWAT story is that Apple has a secret secondary hash that's checked on a collision. That's the part of the SWATting story that feels difficult on a technical level. However, there are also really smart people out there so it wouldn't surprise me if a successful attack strategy is developed at some point given time.

Sure. I mean, my main concern would be people planting actual illegal images. Not just colliding hashes. If anything, a handful of images that have hash collisions, once they made it to the authorities, would then be reviewed in detail and shown as a false positive, and then ignored in the future / whitelisted. Or investigated because someone is generating images to directly tamper with the program / frame people.

No one is going to be prosecuted on "significantly downscaled ... ambiguous" versions of original fake images with a hash collision that flagged a review and was handed to the FBI accidentally because a "minimum wage" fatigued person passed it on.

I get the counter-arguments, but the hash collision thing is just, sort of... weird? I even get the argument that an innocent hash collision may have your personal and private images reviewed by some other human - and that's weird. But I can't really see it going further (you'll be arrested and sentenced to life in prison from the HASH COLLISIONS!).

It's just using technical terms to scare people who don't understand hashes and collisions and probability, and not really founded on reason.

> once they made it to the authorities, would then be reviewed in detail and shown as a false positive, and then ignored in the future / whitelisted

Which typically will be a court case, or at least questioning by police. This can be quite a destructive event on someone's life. Also, there's no mechanism for whitelisting outlined in the paper, nor can I imagine a mechanism that would work (i.e. now you've got a way to distribute CP by abusing the whitelisting fingerprint mechanism or you only match exact cryptographic hashes which is an expensive CPU operation & doesn't scale as every whitelisted image would have to be in there).

Also, your entire premise is predicated on careful and fair review by authorities. At scale, I've not seen this actually play out. Instead either the police will be underworked & not investigate legitimate cases (too many false positives) or they'll aggressively police all cases to avoid missing any.

Going down a rabbit hole, but a colliding image could be an adult that doesn't look like an adult.

> email someone with the colliding image embedded in the MIME document. Set height and width equal to zero or one pixel.

(I think) the complaint is: how is that different from just using CSAM images, no collision required?

I also don't understand the vector everyone seems worried about. Also considering that perceptual hashing isn't new, as far as I'm aware, and it hasn't seemingly yet led to any sort of wave of innocent folks being screwed over sham illicit images.

I think there _is_ an argument to be made about a system like this being used to track the spread of political material, and it's easy to see how such a system would be terrible for anyone trying to hide from an authoritarian power of some type, but that'd already require Apple is absolutely and completely compromised by an authoritarian regime, which isn't high on my list of concerns.

The main issue is that the system is basically a bit of snitching spyware dolled up with cryptographic magic to make it only work with really bad stuff, honest.

As recently posted on HN [1] one should be very wary of backdoors, no matter how much one believes only the right guys could ever use them. Once they're there, they're there: it's arrogant beyond believe to think that opponents of yours won't exploit them.

I won't use an apple product with this feature. I've been using apple's ecosystem since about 1994.

[1] https://twitter.com/matthew_d_green/status/14334701097425182... and https://news.ycombinator.com/item?id=28404219

I understand your points on backdoors, but I don't understand people trying to argue that the "Cryptographic Magic" is the bad part that will send people to prison due immediately upon "HASH COLLISIONS", in my view, takes away from the actual concerning points.

What most people are focused on is that this is spyware built in to the operating system. The fact that perceptual hashes have some weak points could also lead to problems, but that's not the main focus of most opposition to this system.

> Apple is absolutely and completely compromised by an authoritarian regime

I don't understand this, they can just be legally compelled.

And they already are, Apple (and indeed all companies) have to follow all sorts of rules in all sorts of countries. Some of those rules are fairly harmless, some of them are about radio power levels, some of them are "don't show the Taiwanese flag in China".

And I also understand the concerns with this (and the potential downsides of the technology).

But a motivated bad actor has a lot easier time just putting an image of the Taiwanese flag or propaganda on someone's phone than trying to make it a hash collision that triggers... If an attacker is really after someone, I would expect them to put the actual material on that person's phone...

... It's like trying to frame someone for drugs in their car and going through the hassle of synthesizing a chemical that triggers drug dogs to react, but it isn't actually the drug. Wouldn't they just... buy drugs and stick them in the car?

> Wouldn't they just... buy drugs and stick them in the car?

Maybe they want to create too many false positives deliberately, or maybe they do it just because they want to see if and how synthesizing such a chemical can be done.

When putting pictures on someone's phone or computer, there are ways to add false positives as well as maybe doing false negatives sometimes (e.g. by encrypting the picture or using an uncommon file format so that it must be converted, or using complicated HTML/JS/CSS to render it instead of just a picture file).

Also, if someone has the picture or drug or whatever to find if it is what they are, can you accuse them (maybe they are the police) of liking pictures and drugs, too?

Yeah sorry, I was a little vague. I consider that willingness to comply as already having been compromised. And I think, to be fair, if companies like Apple are ever in the position of using technologies like this to track individual dissidents of an authoritarian regime, we are already royally screwed.

But, to be clear, you make a legitimate point.

> there _is_ an argument to be made about a system like this being used to track the spread of political material

How so? Unlike other cloud providers, which do scan all uploaded images server side, this system is specifically designed to prevent this.

(As you say, if Apple is entirely compromised, then all bets are off anyway.)

The colliding images stopped looking like a grey mess within the week and just looked like a normal low quality image.