EFF Pressures Apple to Completely Abandon Controversial Child Safety Features

[bobcomer]

It's called running models. Do you really think Apple just made up a number out of thin air? LOL!



You said lie JUST TO MAKE A BUCK. I even quoted your exact words. Also, we all have the ability to lie, so does that mean everything we say should be called a lie?



Laugh all you want. Doesn't change facts.

Running models doesn't mean a dang thing, statisitics, not fact, no matter how much you use that word. Models isn't real data. I never made the statement that they created it out of thin air, and I think it's a VERY deliberate number.

Facts, ROFL!!!!!!!!!!

 

[usagora]

Running models doesn't mean a dang thing, statisitics, not fact, no matter how much you use that word. Models isn't real data. I never made the statement that they created it out of thin air, and I think it's a VERY deliberate number.

Facts, ROFL!!!!!!!!!!

Yikes. At this point, I think we're not getting anywhere profitable, so I'm going to leave it at that.

 

[TheToolGuide]

It's their property and responsibility, they can do what they want with it. If I want to use it for iCloud, I have to accept that they'll scan it and I do. My phone is my private phone, only letting out what info I want let out.


Scanning on their servers can't get to everything I have on my phone, and like I said, it's their hardware and maintenance, not mine.


That's just it, I don't think I'll be able to control it always -- once there's a foot in the door. Server side is never under my control and can't be thought of that way. It's public, even if it takes a password to access it, I always assume Apple has that password.

I did trust them, and it was my mistake.

Hmm, interesting. I assume I have the same level of control on my iPhone as I do my iCloud server side information given the documentation published and my understanding of it. My reasoning is that if I do trust Apple than it is exactly what they say it is in their documentation. If they are betraying my trust or I don’t trust them than on my phone or on their server it does’t matter and they can do what they want with it.

Saying you‘re okay with server but not with iPhone is a compromise/distinction that doesn’t make sense, to me, if you trust them in one location but not in another. Like you either have control or you don’t have control.

In my view, even though I think it unlikely their servers would be compromised or easily compromised, I can’t control attacks or government manipulation on that location. Maybe influence it but not control. On my phone though I control the access to it and how the data is accessed. It would be my choice to be influenced or compelled to relinquish access to my phone and not controlled by some outside entity. This of course comes down to ‘trust’. Since CSAM hash comparisons happen on my phone I control whether they upload or not to iCloud. Its also a highly specific thing they hash against. iCloud server side scanning is everything and also much more resource intensive and a much bigger privacy issue.

By my logic if you do not trust Apple neither service side or iPhone side should be okay. If you did trust Apple then I would think the phone much more secure than a server.

 

[jntdroid]

Now I’m curious why you’d be okay with scanning in the server side and not on your phone? Why does that seem better for you? Seriously, genuinely want to know so I can temper my view. For me something happening locally on my phone that I control would seem safer than something that happens server side that I don’t control. I get them implementing the feature in iOS is out of my control. But my control of its operation is mine to control. Just like the A.I. algorithm implimented in iOS is out of my control and sharing it is in my control.

But you don't really have control over it locally. Forcing you to disable something that is highly valuable to a lot of long time users (iCloud photo backup) in order to turn off local CSAM scanning is not control.

True control would be a prompt asking if you want local CSAM scanning or cloud CSAM scanning on your account.

The general reasoning behind preferring it in the cloud is basically that people expect cloud material to be scanned - it's on the company's servers. They don't want that happening on their physical device that they own - even if it only happens with a link to iCloud. For those that truly understand how the process works, the disagreements usually come down to whether or not you're ok with or offended by the idea of Apple using the physical device to do the scanning.

 

[bobcomer]

Hmm, interesting. I assume I have the same level of control on my iPhone as I do my iCloud server side information given the documentation published and my understanding of it. My reasoning is that if I do trust Apple than it is exactly what they say it is in their documentation. If they are betraying my trust or I don’t trust them than on my phone or on their server it does’t matter and they can do what they want with it.

We very much differ on that. I bought my iPhone and am the owner, Apple bought their servers and they are the owner is the way I think.

In my view, even though I think it unlikely their servers would be compromised or easily compromised, I can’t control attacks or government manipulation on that location. Maybe influence it but not control. On my phone though I control the access to it and how the data is accessed. It would be my choice to be influenced or compelled to relinquish access to my phone and not controlled by some outside entity. This of course comes down to ‘trust’. Since CSAM hash comparisons happen on my phone I control whether they upload or not to iCloud. Its also a highly specific thing they hash against. iCloud server side scanning is everything and also much more resource intensive and a much bigger privacy issue.

This CSAM scanning takes that control away from me. (to me, of course, I know we disagree on this too.) It makes the phone do something I don't approve of. (queue 1984 and its surveillance ideas. That book had a very profound impact on me the first time I read it a very long time ago.)

 

[dk001]

Hardly.



Turning off iCloud for photos isn't "getting around" anything, because now they're not able to use the service at all. The whole point of what Apple is doing here is NOT to detect CSAM that somone plans to keep on their phone, but rather to detect CSAM that somone intends to upload to iCloud.



Of course. Not sure how this is relevant to my point, though.



If you say so. And like I said, even if they were 1000 times off, it would STILL be a huge number (1 billion).



Correct - but single false positives are irrelevant because they trigger nothing.



Nonsense. There's practically no chance that a lawful device user's account woulf be flagged, and even if it were, nothing would come of it because of the manual review process.

I think we are done discussing this. It has reached a point where you haven’t really read what Apple has been saying, let along other professional speakers. Instead you are trying to form points that support your stance but fail to take in known facts.

You are okay being spied on and being kept in the dark on the outcome of it. Your choice.

Later.

 

[usagora]

I think we are done discussing this. It has reached a point where you haven’t really read what Apple has been saying, let along other professional speakers. Instead you are trying to form points that support your stance but fail to take in known facts.

You are okay being spied on and being kept in the dark on the outcome of it. Your choice.

Later.

That's a hilarious set of assertions, and how convenient for you to throw them out there and then say you're done discussing this to avoid having to follow up to actually back up those assertions. I've read everything Apple has said and everything in my last post lines up with that. Also, last time I checked, "spies" don't announce their intentions to you. Sort of blows that whole "spy" part - just saying. But I understand - you're going for the emotional/dramatic effect instead of reality.

 

[dk001]

That's a hilarious set of assertions, and how convenient for you to throw them out there and then say you're done discussing this to avoid having to follow up to actually back up those assertions. I've read everything Apple has said and everything in my last post lines up with that. Also, last time I checked, "spies" don't announce their intentions to you. Sort of blows that whole "spy" part - just saying. But I understand - you're going for the emotional/dramatic effect instead of reality.

Love how you do your best to insert emotion into a discussion. If you have read everything, you are doing some serious pick and choose. Wow. You do a lot of it in just the first sentence in your previous post. Even your attempted deflection of the term "spy". You conveniently choose the single definition that supports your "statement" ignoring the way it was used.

Try again? Maybe try looking at the functionality instead of focusing on the term "CSAM"? How about leaving out your attempts to "rationalize" your points and instead focus on what it does and should it be allowed?

 

[usagora]

Love how you do your best to insert emotion into a discussion. If you have read everything, you are doing some serious pick and choose. Wow. You do a lot of it in just the first sentence in your previous post. Even your attempted deflection of the term "spy". You conveniently choose the single definition that supports your "statement" ignoring the way it was used.

Try again? Maybe try looking at the functionality instead of focusing on the term "CSAM"? How about leaving out your attempts to "rationalize" your points and instead focus on what it does and should it be allowed?

Ah, so you're NOT done discussing this. Shocker. You are the one inserting emotion/drama into this discussion, not I. That's why people like you purposely choose (and misuse) words such as "spying" - to illicit and emotional response from people who aren't educated on the topic ("oh my - Apple is SPYING on me! This is awful! I'm selling my iPhone!"). You know darn well that people immediately associate "spying" with secret observation by a human, especially in this context - they're not going to think of the loose, poetic sense of "looking" ("I spy with my little eye . . ."). Apple sees NOTHING except data on illegal images. THAT is the reality. You are purposely twisting reality to fit your anti-Apple agenda.

 

[TheToolGuide]

But you don't really have control over it locally. Forcing you to disable something that is highly valuable to a lot of long time users (iCloud photo backup) in order to turn off local CSAM scanning is not control.

True control would be a prompt asking if you want local CSAM scanning or cloud CSAM scanning on your account.

The general reasoning behind preferring it in the cloud is basically that people expect cloud material to be scanned - it's on the company's servers. They don't want that happening on their physical device that they own - even if it only happens with a link to iCloud. For those that truly understand how the process works, the disagreements usually come down to whether or not you're ok with or offended by the idea of Apple using the physical device to do the scanning.

Okay this issue again here is trust. Something that is debatable and may never be gained. Giving you a choice between scanning on the device and scanning on iCloud servers (you have to choose one or the other) is an interesting approach. Let me punch some holes in it. Let me preface this with I think the reasoning Apple has for local is more for efficiency, scalability, and high success.

Assuming this is going to happen someplace local or server side.

First efficiency:
Millions of iPhones processors creating hashes of the images on the iPhone that are then compared to a known CSAM list on your phone is much faster and more power efficient than probably all of Apple’s servers combined. Also your iPhone only has to convert hashes for photos on the fly. Servers would constantly have to be doing this. Lots of processing and network load. I doubt this was a motivation for Apple but probably something they would consider. Also all the stuff in you iCloud is encrypted including the photos. They would have to decrypt every photo to then make a hash to then compare it to known CSAM. I don’t think Apple really wants to have access to decrypted photos and really only wanted to address the CSAM. Since the photos are not encrypted on your phone (well they are but not where the hash is taking place) its easier to create the hash there. They are also only really interested in decrypting the photos of known CSAM. The fact that they had something like 500 reports to authorities of known CSAM compared to FaceBooks millions of reported CSAM violations probably tells you a lot about how they don’t have access to your photos and don’t want to.

Scalability:
Assuming this CSAM is doing exactly what its intended to do and is successful at finding and stopping this abuse with kids. If Apple does want to share this API out to other developers it would be easier to scale on the phone side. Since its happening on your phone and not server side they don’t have to worry about a 3rd party photo app being compromised by a shadow agency/government or a shady app. Its all locked down to your phone. For something that you want to have a lot of success with accomplishing this highly focused search you want to make sure it can’t be compromised. Giving Pinterest, instagram, or any other photo company access to APIs they control on their servers is just asking for maliciousness.

See I don’t think Apple really wanted to do any of this but did want to address what is likely a huge hole in their iCloud Photos housing large amounts of CSAM. In essence they don’t have to see any of your safe/legal photos and the pedophiles turn themselves in. I also don’t think Apple cares if the pedo‘s like using their iCloud photo backups. This will also act as a deterrent.

 

[TheToolGuide]

We very much differ on that. I bought my iPhone and am the owner, Apple bought their servers and they are the owner is the way I think.


This CSAM scanning takes that control away from me. (to me, of course, I know we disagree on this too.) It makes the phone do something I don't approve of. (queue 1984 and its surveillance ideas. That book had a very profound impact on me the first time I read it a very long time ago.)

1984 is a book where monitoring was happening and the government controlled the psychology of the populace to suit their views. Though a good book this isn’t the same thing. One thing thats great about books is they convey interesting ideas with emotions. However it is also important to temper our application of fiction onto reality. Apple‘s marketing used these emotional feelings the public had about the book 1984 when making their commercial in 1984 Super Bowl ad. But in reality none of that was really accurate. They wanted people to see Apple as a better option by negatively labeling IBM. The same is happening today against Apple all over the news and social media on a number of different toptics not just CSAM.

So I guess I’m trying to have you look at the idea of what Apple is stating they will do with CSAM on iOS 15. Casting it under rainbows or shadowy dark colors technically doesn’t have anything to do with the idea. Its what they do with the idea and also the work they put into it to make sure it remains true despite positive or negative press.

To be fair you ‘are’ the owner of the iPhone hardware. However Apple owns the iOS software and its service. Its an intangible thing you can’t own and can only utilize it. You could choose not to upgrade to iOS 15 and be gated from other new features by never upgrading. I get that you don’t like that. Its not really ‘you want your cake and eat it too’ but sort of. When you bought their phone you also bought an agreement to use iOS (for the most part). You could jailbrake your phone, which isn’t illegal, but you may lose some of the Apple features. I think Apple does have a right to how their software is used in future iterations and that is where folks disagree. Apple got the performance out of their phones by tying software and hardware together really well.

Android and other phones will give you more control but also maybe less in others. So then the debate is Apple sold you a promise to not compromise your private data. The nuance to it is they are very surgically cutting out the CSAM and doing checks to make sure its accurate. The rest of it they don’t see and if something does somehow make it through their idea states they will fix it so it won’t happen again the same way. So the argument could be made ‘well those gross CSAM photos are your private images‘ then yes I guess they are but I’m okay with you going to jail over getting caught with them.

So if your concern is you’re losing control over something that you don’t approve of you might need to think about what you’re losing control over. Since I don’t think you have CSAM on your phone then you’ve really not lost control of anything, you aren‘t the target and won’t be affected by this. If you truly understand how it works then you’d realize its only something that you’ll monitor but likely not have to do anything about if it only does what it states it will do.

Believe me that if Apple did do something that actually was like what happened in 1984 I’d be picking up the fight along with everyone else. As it stands people are casting the shadow of 1984 on it which doesn’t mean its 1984.

 

[dk001]

Ah, so you're NOT done discussing this. Shocker. You are the one inserting emotion/drama into this discussion, not I. That's why people like you purposely choose (and misuse) words such as "spying" - to illicit and emotional response from people who aren't educated on the topic ("oh my - Apple is SPYING on me! This is awful! I'm selling my iPhone!"). You know darn well that people immediately associate "spying" with secret observation by a human, especially in this context - they're not going to think of the loose, poetic sense of "looking" ("I spy with my little eye . . ."). Apple sees NOTHING except data on illegal images. THAT is the reality. You are purposely twisting reality to fit your anti-Apple agenda.

Apparently you are not ready for a real discussion.
Let me know if you are. Till then I will restrict my comments to folks willing to consider all sides.

Later.

 

[dk001]

For folks who are interested (@TheToolGuide ), here is some great material that explains what CSAM really is.

Child Sexual Abuse Material

Child pornography, better described as child sexual abuse materials, is illegal! It re-traumatizes a victim every time the material is shared online and has lasting damage.

www.missingkids.org

Couple of items in here I was not aware of … like the max age.

 

[usagora]

Apparently you are not ready for a real discussion.
Let me know if you are. Till then I will restrict my comments to folks willing to consider all sides.

Later.

Wow, project much? It's so obvious that you're copping out of addressing my points by making these snide remarks every time you reply. I have no further interest "interacting" with you. So go ahead and make your little quip about THIS post and get it out of your system. I'm moving on.

It's really unbelievable how people behave on forums sometimes. smh....

 

[bobcomer]

So if your concern is you’re losing control over something that you don’t approve of you might need to think about what you’re losing control over. Since I don’t think you have CSAM on your phone then you’ve really not lost control of anything, you aren‘t the target and won’t be affected by this. If you truly understand how it works then you’d realize its only something that you’ll monitor but likely not have to do anything about if it only does what it states it will do.

Nah, I already moved to android. (S Z Flip 3) The very idea of on device surveillance is unbearable.

To be fair you ‘are’ the owner of the iPhone hardware. However Apple owns the iOS software and its service.

Aye, but that OS can't run on my person without me carrying it in my hardware. What I do with my hardware is mine to choose.

So then the debate is Apple sold you a promise to not compromise your private data.

They actually sold me a phone. (I actually bought it from Apple's website) I chose it based on features, but that's it. I trusted Apple when they kept talking about trust, and I trusted them over other cell manufactures -- but that trust is gone, so I bought another phone. It was time and I was going to get an iPhone13, but no longer. I'm actually quite happy with what I bought, it has a lot of features Apple phones don't have, and I find I like them.

So if your concern is you’re losing control over something that you don’t approve of you might need to think about what you’re losing control over.

It's WAY more than just that. If it stays, I leave, there really isn't much decision or soul searching to do..

Believe me that if Apple did do something that actually was like what happened in 1984 I’d be picking up the fight along with everyone else. As it stands people are casting the shadow of 1984 on it which doesn’t mean its 1984.

That's just it, I see this as the start of that. And it's the governments to worry about, not Apple, they're just the enabler. After the last 4 years and seeing what the U.S. could morph into, I trust them even less than Apple.

I know I'm being extremely stubborn on this, but sometimes you do have to draw a line you wont cross.

Anyway, I wonder if our age difference might be the biggest stumbling block to really understanding the other's position -- mine's 61. Kind of boomer, kind of the generation after that.

 

[scvrx]

TheToolGuide said:​

Apple‘s marketing used these emotional feelings the public had about the book 1984 when making their commercial in 1984 Super Bowl ad. But in reality none of that was really accurate. They wanted people to see Apple as a better option by negatively labeling IBM. The same is happening today against Apple all over the news and social media on a number of different toptcs not just CSAM.

It's not happening. Apple enjoys unbelievable amount of positive coverage and irrational reactions all over the world.
Please, check Apple related news at the current moment.
All promotions and lots of them are free. Consumerism is alive and well and media want's the eyeballs so every screeching voice at the moment is irrelevant.
Apple PR is on overdrive.

So I guess I’m trying to have you look at the idea of what Apple is stating they will do with CSAM on iOS 15. Casting it under rainbows or shadowy dark colors technically doesn’t have anything to do with the idea. Its what they do with the idea and also the work they put into it to make sure it remains true despite positive or negative press.

In a simplest technical explanation possible: Apple CSAM solution is processing on user data trough third party criteria, and this is the important part, government funded private corporation provides "the hashes".
Apple clearly stated that implementation is giving an option every country to provide their version of the hashes database.
Your precious 4th amendment is out of the picture. Apple and organization providing the search criteria are private corporations.

Apple sold you a promise to not compromise your private data.

Exactly. This is the biggest marketing bait and switch in commercial history.

So if your concern is you’re losing control over something that you don’t approve of you might need to think about what you’re losing control over. Since I don’t think you have CSAM on your phone then you’ve really not lost control of anything, you aren‘t the target and won’t be affected by this. If you truly understand how it works then you’d realize its only something that you’ll monitor but likely not have to do anything about if it only does what it states it will do.

I understand how it works and this is the problem. A lot of technically educated people lack system design skills and are reading Apple's tech docs without looking into the big picture.
In current Infosec environment with biggest infrastructure risk from decades implementing a system like Apples screams "opportunity for abuse".
Apple is ignoring the fact that they are already compromised by Pegasus/NSO.

Believe me that if Apple did do something that actually was like what happened in 1984 I’d be picking up the fight along with everyone else. As it stands people are casting the shadow of 1984 on it which doesn’t mean its 1984.

Apple actually is more dangerous than IBM at the time. Apple is a gateway for data extraction, communication control and active policing.
Apple has their hands in data services, entertainment services, payment services, healthcare services, etc.
Compared to this IBM is a joke.

The bottom-line is that with one move Apple destroyed expensive for shareholders public perception of guardian of privacy.
If I am a shareholder in this company I will expect upper management removal as a minimum. The CEO also.

Yes people are naive and stupid. They want to believe.
That is a fact. But don't underestimate the power of technically educated people who are not sellouts, we are created this monster and eventually we will bring it down.
The arrogance and double-faced behavior of corporate zealots at Apple is staggering.

 

[steve09090]

Are you so oblivious that you think that matters in terms of privacy? A hash is nothing more than a perceptual summary that captures essence of the statistical structure (perceptual features) of the of the image. I and many others don't want Apple scanning either raw images or summaries of images on our iPhones.

I guess I don’t have anything to hide.

Could you tell me how apple is able to inform parents of nude photos teens get, if apple doesnt scan every photos without knowing hashes? im quite sure that teens dont send known/hashed csam pics to each other.

"We want to help protect children from predators who use communication tools to recruit and exploit them, and limit the spread of Child Sexual Abuse Material". https://www.apple.com/child-safety/

I guess you’re either for Safety or against it.

 

[dk001]

Interesting read from Aug 2020.
Good read on the technology, concerns, and implications from both sides of the debate.

The Law and Policy of Client-Side Scanning - R Street Institute

In recent years, two unfortunate trends have converged in cybersecurity—the growth of child pornography distributed online and the proliferation of encryption systems that enable the distribution of all forms of content (both lawful and illicit) in a manner that is inaccessible to service...

www.rstreet.org

 

[steve09090]

Nah, I already moved to android. (S Z Flip 3) The very idea of on device surveillance is unbearable.

That’s Google isn’t it?

You should be perfectly safe from any malware or spying then… 😂😂😂

 

[dk001]

International version of NCMEC. Seems they all align as far as I can tell.

https://www.icmec.org/wp-content/uploads/2018/12/CSAM-Model-Law-9th-Ed-FINAL-12-3-18.pdf

 

[dk001]

That’s Google isn’t it?

You should be perfectly safe from any malware or spying then… 😂😂😂

Actually, yes. Mostly. If you want to put in the effort (minimalish ).
I’m running a OnePlus 9 Pro and I was surprised on how much you can deGoogle and deOEM these devices. There are great groups out there that are willing to help.

Now you cannot get rid of everything, however you can severely curtail what they do collect.

With the Z Fold 3, the challenge will be restricting Samsung’s stuff. But it is doable.

 

[jntdroid]

That’s Google isn’t it?

You should be perfectly safe from any malware or spying then… 😂😂😂

In their defense, Google does at least give you solid granular control over what they can and can’t do with your data. If you don’t take the time to figure that out, then yes, they eat up your data. But they do provide better data control than most tech companies. I discovered this when attempting to “de-google” my life over the last couple of years.

 

[dk001]

Wow, project much? It's so obvious that you're copping out of addressing my points by making these snide remarks every time you reply. I have no further interest "interacting" with you. So go ahead and make your little quip about THIS post and get it out of your system. I'm moving on.

It's really unbelievable how people behave on forums sometimes. smh....

Try reading post #468. It might grant you a glimmer of my concern (and many others).

 

[dk001]

I guess I don’t have anything to hide.

"We want to help protect children from predators who use communication tools to recruit and exploit them, and limit the spread of Child Sexual Abuse Material". https://www.apple.com/child-safety/

I guess you’re either for Safety or against it.

Or inadvertently lacking critical knowledge.
Try reading the link on Post #468.

Some really good info there. Wonder if this is around the timeframe Apple started this project?

 

[Schismz]

All of this is kinda theatre of the absurd and probably some group of people in PR who are going to not have wonderful performance evaluations. I don't care what happens in iCloud, anymore than Google, or Facebook or anyplace else. Whatever I've chosen to put there, on their servers is my choice. If I want to encrypt it end-to-end myself, I can, even if it's not encrypted on iCloud by Apple. I do not actually lay awake nights worrying about my iCloud email, I also don't really care. While I avoid Google as much as possible and have 0 use for Twitter or Facebook, I'm fully cognizant my email is being scanned in clear-text, because, that's the nature of unencrypted email and SMTP / IMAP, email is akin to sending an open-faced postcard almost anybody can intercept/scan. I actually belong to vast majority of people who isn't committing crimes, planning murders, or sending child porn in my email. Scan away, I gave up that privacy when I didn't run my own mail server or use protonmail or phantom or whatever.

Putting it in Apple's cloud is a choice I've made.

However, Dear Apple: get the **** out of my device. I didn't rent it, I own it. I don't want to have to jailbreak my own property, this is entering ludicrous territory.

I guess the "screeching voices of the minority," have been heard and hopefully Apple will pull their head out of hiding in the sand. Privacy is one of the very foundational reasons that people pay their absurd Apple Tax. I'm fine with it, but deliver on your marketing. I'm really not here for the pastel keyboard and all singing, all dancing, crap of the world, where you keep loading up NeXTSTEP, Mac OS/X, macOS, with more and more brilliant garbage like emojis and stupid video tricks. I just want the OS to work correctly, and remain somewhat aesthetically pleasing while retaining compatibility and tight integration with all the iCrap you sell and want me to purchase. Crazy, I know.