That having been said, given how they paraded their backdoor approach as a way to eat their cake and have it too, it's unsurprising that it attracted the attention of governments. They perhaps thought that implementing a scheme like this would put them ahead of the game, showing legislators they're self-regulating to work on these problems. In actuality, they're really just putting the future of digital privacy in dire straits.
Play stupid games, win stupid prizes.
Fucking thank you.
I have spent a lot of time in security. I spend a lot of effort on privacy. I keep abreast of the state of the art, I donate to the EFF. I spent a year auditing security at one of the largest cybersecurity firms in the Western world. I’ve read the texts, I’ve taken the classes.
I’m not saying I can just do bitwise AES over plaintext in my head. But I had no issue understanding the white papers Apple released that described the feature.
That didn’t convince me one iota that it was either a good nor necessary idea. It simply served to highlight the things Apple was being fairly arrogant about. And I say that as someone who daily-drives multiple Apple devices and am highly bought into the ecosystem.
They built a large part of their trust model with that effort upon the idea that two governments either wouldn’t or couldn’t collude to inject non-CSAM hashes into their database. It’s like they’ve never heard the term “Five Eyes” despite harboring serious credentials and contracts in _all_ the right spaces to know exactly how possible that would be.
It was a technologically clever idea, and if we lived in a “it’s this or that” world where we had to choose which technologies would be used to surveil our devices, it would be one of the best options developed to date.
However I don’t accept that premise because it’s not true.
Edit: typographical cleanup.
This is not correct. In the event that this happened, there would still be oversight at Apple before reporting to authorities.
But those hashes are produced and provided to Apple (edit: well, to any consumer of the hashes) by government backed actors. (Edited to replace “government agencies” with “government backed actors”.)
My misreading was that (paraphrased) “Apple could ensure the hashes they received were only for CSAM.”
That isn’t what you said. You noted that (paraphrasing) “internally Apple would have some validation functionality to ensure they were not reporting non-CSAM content.”
I was going to say I think your point is orthogonal, but I understand how it’s a response to what I wrote. I think we could rely on a reasonable set of people differentiating a perceptual hash of CSAM from non-CSAM content. That is no guarantee, but if their system worked as described then at some point they would be able to validate the actual stored images uploaded and know whether or not it was CSAM in an account.
Just leaving here that I would counter to others that make your original point constrained to CSAM flagged content only, that:
1. Given the fact that collisions were demonstrated in public before the system was fully implemented, this failure mode had the potential to create an unknown volume of false positives that Apple would have to deal with (which would unnecessarily expose user data to Apple contractors or employees).
2. We probably don’t want to enable corporations to have this kind of power (see recent stories regarding similar false positives at Google).
3. There was proposed no detailed plans for any sort of procedures about what happened next. What happens when Apple makes a report that was “close to the line” and later found not to be CSAM? The perceptual hash concept was not without vectors for human failures. What recourse would there have been if Apple closed an account due to a false positive?
I saw very little evidence of that. Practically everybody against the idea thought the device determined what was a match and uploaded evidence to Apple. Practically everybody against the idea thought “the” hash was broken. Practically everybody against the idea confused a hash false positive with the system’s false positive.
Yes, there were a few thoughtful criticisms and I would have liked to have seen more of them. But they were drowned out by abject nonsense.
> given how they paraded their backdoor approach as a way to eat their cake and have it too, it's unsurprising that it attracted the attention of governments.
It didn’t though? Has there been any government who wanted to take that system up? They all want something a lot more intrusive; the same kinds of things they have been asking for a long time before Apple’s proposal.
Doesn't the system output the result of the hash?
What is the difference?
As opposed to Google trying to have parents arrested for seeking medical care for their children during the pandemic lockdown?
> His wife called an advice nurse at their health care provider to schedule an emergency consultation for the next morning, by video because it was a Saturday and there was a pandemic going on. The nurse said to send photos so the doctor could review them in advance. With help from the photos, the doctor diagnosed the issue and prescribed antibiotics, which quickly cleared it up.
Because technology companies routinely capture so much data, they have been pressured to act as sentinels, examining what passes through their servers to detect and prevent criminal behavior. Child advocates say the companies’ cooperation is essential to combat the rampant online spread of sexual abuse imagery. But it can entail peering into private archives, such as digital photo albums — an intrusion users may not expect — that has cast innocent behavior in a sinister light in at least two cases The Times has unearthed.
“I knew that these companies were watching and that privacy is not what we would hope it to be,” Mark said. “But I haven’t done anything wrong.”
The police agreed. Google did not.
https://www.nytimes.com/2022/08/21/technology/google-surveil...
That's not just scanning things you upload to a public facing website, that's scanning everything on the device.
Bad start. I never mentioned Google.
> ... [the remainder of the message] ...
I do not understand how this is meant to weaken the case against what Apple did at all. If anything, it strengthens my resolve that tech companies should not be at liberty to even make these decisions.
Only a matter of time before an authoritarian regime forced them to expand its scope. Create a Pandora's box and it will be opened.
This is incorrect. Last time it went to court, Apple used very different arguments.
> Now, there would be a way - once it's built it's built, there is no going back.
Then why is the British government not asking for the system Apple designed? They are asking for something far more intrusive. Apple’s system is irrelevant to that.
If you're just asking me, they bungled it. MacOS shouldn't have ever gotten stuck in the Windows 8 Software as a Service trap, because it radically redirected their trajectory from "well-made personal devices" to "golden handcuffs". Don't believe me? Just try to install a freedom-respecting OS on your iPhone. You can't. It's a goose-chase, because Apple insists they don't even make computers in the first place. It's an iPhone, running a very special superior version of UNIX you're not entirely allowed to look at, but you can trust is secure.
So of course an authoritarian regime can compel spying regardless. They've probably been doing it for the past decade, given what we know about FIVE EYES and PRISM. When you're a company like Apple or Microsoft, they just update the software with the requested backdoor/vulnerability installed and push it to the closed codebase. Even Apple's proposed E2E encryption could be backdoored. Nobody would ever know the wiser.
If you want the reason I'm mad, it's because it echoes the reasons I left the ecosystem with MacOS Catalina. The idea of Apple defaulting to you trusting them on so many things is kinda sickening. They've had the opportunity to build groundbreaking trustless systems with unparalleled openness and plausible deniability for all user data. Now the users are bartering for a better (but also closed) E2E system with a company that doesn't want to hear them out. It's not my jam, I'm not going to be held hostage by my computer because Apple has a fetish for making extreme decisions on the behalf of their users.
Fortunately Apple has abandoned that plan and now supports full end-to-end encryption for iCloud Photos. It’s still opt-in, but hopefully that will get easier in the future.
I don't buy this because everyone I know turns off iCloud Photos when it causes you to run out of your measly 5GB of free storage space, which makes the OS insistent about you fixing it to fix backups not uploading. For the people that do pay more, they keep iCloud Photos on specifically for the photo syncing aspect.
Similarly, I am not aware of any constitutional rule that prevents a private company like Apple from installing client-side software into your phone OS that scans the local photos on your private device even if you never upload them, as long they don't do the scanning at the government's direct behest and you give them permission by agreeing to their ToS.
The important constitutional principle here is "is this private company acting as an agent of the government." The important civil principle is: "do we, as citizens and customers, want our government and phone manufacturers to scan private files and submit automatic police reports." Once you've decided those questions, the physical/logical location of the files is a detail that only we nerds care about.
No. They appeared to put in this effort, but at the end of the day they built a system which could be used for scanning any file on your device for any reason, saying "oh it's only for files uploaded to icloud" was obviously the first step. And then of course the fact that if anything was deemed innapropriate it would have been submitted to their own verification centre where someone would actually physically look at your pictures and then forward them to law enforcement, without you being notified that this has happened in any way - that doesn't sound like maximising privacy to me.
>>but I wouldn’t be opposed to the scheme Apple wanted to implement.
I would. It was a horrendous implementation and any on-device scanning should always be opposed to the maximum extent that you can bare.
They could already be doing this though, right? Unless some trustworthy external auditor has gone through the iOS/macOS/iPadOS source and audited that they don't (good luck with that.)
To be clear – you are saying this was an easy thing for Apple to construct?
> but at the end of the day they built a system which could be used for scanning any file on your device for any reason
This is factually untrue and also not in contrast to the amount of effort they put in.
> And then of course the fact that if anything was deemed innapropriate it would have been submitted to their own verification centre where someone would actually physically look at your pictures and then forward them to law enforcement
This is also factually incorrect. Did you read the technical documentation Apple published?
No.
>>This is factually untrue and also not in contrast to the amount of effort they put in.
How so? I fail to see how this system has anything that would prevent it from being used to scan any file on the device? Sure their design is only for pictures, but why would it be limited to them?
>>This is also factually incorrect.
It's not, that is exactly what their technical paper says.
>> Did you read the technical documentation Apple published?
I did, multiple times, I've been having these arguments for a long time now.
This kind of comment is exactly why they said lots of people didn’t understand the system.
Because it’s utterly untrue & appears to not display ANY understanding of the underlying system at all
It’s not true, it’s not how that works, it’s not how any of it works. It’s also something that could ONLY be true of they changed how everything worked.
I don't know why you keep implying I don't understand how the system works - I do.
And I literally don't see how you can take your position and believe in it.
The system as proposed would generate a special "similarity" hash for pictures that are about to be uploaded to icloud - then those hashes would be compared against an uninspectable database of hashes provided by apple in collaboration with law enforcement agencies.
Literally all that would need to change here is that this system would need to scan all files not just pictures(trivial) and either all the time or on request instead of on upload to icloud(trivial). And of course it's silly to believe nation states wouldn't force Apple to add their own hashes of anything they want into the database - after all there is no oversight process over this. This isn't a major change to how the whole system works, it's a minor change and one that definitely would be made with time "because think of the children/terrorists/etc"
You really don't see it as an absolultely inevitable consequence of this system being implemented and in fact just existing at all? If no, then you have more trust in Apple than I do.
I read the details. I think I understood it perfectly well. I found it very objectionable.
I think there’s a strong argument for and a strong argument against the system Apple designed. I wanted that discussion to be had instead of it all being washed away with knee-jerk ignorance.
> "No, it was opt-in not required by law."
Your comment indicates the answer is yes.
Trying to figure out where the gap may be...my guess is the view objections come from "people [who] didn’t read."
I found the other replies powerful evidence that other people did read, and had nuanced thoughts on this matter.
Not iCloud, since that would imply it was scanning entire device backups stored in iCloud.
It was intended to scan just the photos that you uploaded to their publicly accessible Photo sharing website, iCloud Photos, in a way that even Apple wouldn't have access to the results unless you uploaded more than 100 photos that matched known kiddie porn.
iCloud Photos is a photo sharing website accessible to the public, like Flickr. It has nothing to do with device backup.
Scanning device backups was not even on the table, unlike at Google, where they have been scanning device content for years now.
https://www.nytimes.com/2022/08/21/technology/google-surveil...
Backups entered the discussion because you claimed iCloud meant backups not photos. And Apple has access to device backups even when they do not exercise it without E2EE.
The article said backed up to Google Photos. And the photos were sent over Gmail and chat. It is not clear device backups were involved or even existed. And device content is a misleading thing to call backups in a discussion about scanning on device.
It was a really interesting scheme that Apple clearly put a huge amount of thought into in order to maximise privacy. But people didn’t read the details and instead imagined it worked in a much simpler way, drowning out any useful conversation about what it was actually doing. The UK approach should be opposed, but I wouldn’t be opposed to the scheme Apple wanted to implement.