University Researchers Who Built a CSAM Scanning System Urge Apple to Not Use the 'Dangerous' Technology

[cupcakes2000]

It is "their" database because it is content apple force feeds onto my device in a coded format I don't know about. Apple is responsible not the FBI or anybody else. Why at all does apple feel to behave like some corporate legal guardian? I am ready to respect the law but this is my job not apple's.

The codes can be matched for verification as stated by Apple.

 

[Mega ST]

Everybody knows this by now. But whatever is in their database I cannot verify. Part of the problem it could be not only child porn and matches can be triggered with manipulated hashes it seems.

 

[scvrx]

Apple - 2000 to 2009 - company building products for professionals and semi-pro people.
Apple - 2009 to today - building everything they can for mass consumer markets, innovating with "color" and "saving the children" for global elites, who are angry as hell that consumers don't listen to corporate media and are trying to think independently.

Everything that we loved about Apple, from hardware design trough UX/UI is gone. People don't realize that they are using this platform because of thousands creative ideas from developers outside Apple camp.
Apple is a machine for illusions, exploiting kids to produce hardware and extorting developers to gain market advantage. We as consumers are responsible. Face it. This is the result (hyper-corporations as Apple and Amazon) of users being stupid. This stupidity is actually the business case for every big corporation and government.

Apple was the last brand standing. But in reality, they sold the user base long ago, with Prism. So in summary:
Apple is for dumb people now. Apple is starting a new marketing campaign already. This is the answer.

Lets go. The new iSpy shiny **** is ready to hit the stores. Did you feel "the magic in the air" already?

 

[Mega ST]

It's not too late yet.
Finally it is a profit minded company. That's okay with me, if customers are respected.

 

[rme]

The argument people here are making is that this system will be abused by governments- they’re ignoring the safety procedures as documented in the white paper.

I completely agree.
We can trust Apple.

They’re also stating that Apple will be bent to manipulate other files and unlawfully search our phones, yet they’re absolutely ignoring the fact that they have always been susceptible to this, it’s their OS. This function changes nothing in this regard.

Correct again! And to the people who keep on whining about what Tim Cook said about Apple not being able to give the FBI a backdoor into people's phones because they don't have the software, and his promise "not develop a “backdoor” for its software" : IT'S ONLY A BACKDOOR IF APPLE SAYS IT'S A BACKDOOR!

 

[cupcakes2000]

I completely agree.
We can trust Apple.

Again, you’re wilfully ignoring actual facts in order to further this agenda, and due to that are actually spread fud.

 

[cupcakes2000]

IT'S ONLY A BACKDOOR IF APPLE SAYS IT'S A BACKDOOR!

It’s much easier to have a serious discussion if you actually engage in one instead of just promoting sensational headlines and buzzwords. There is plenty to be discussed, one would think with such passion displayed, yet nothing is being discussed, just dismissed out of hand.

 

[Yammabot]

There just trying to get parents to buy there kids more iPhones. Talk about exploitation of minors, this is a bad move Apple. Or shall we call you skynet?

 

[bobcomer]

Mocking me is easier than learning things for yourself, evidently. However, it’s pretty easy to educate yourself also, learning is good! Here’s a starter - client side *anything* is more private than server side everything. This premise is especially evident in privacy circles. If it’s done on your device, it’s inherently private.

The argument people here are making is that this system will be abused by governments- they’re ignoring the safety procedures as documented in the white paper.

They’re also stating that Apple will be bent to manipulate other files and unlawfully search our phones, yet they’re absolutely ignoring the fact that they have always been susceptible to this, it’s their OS. This function changes nothing in this regard.

Finally they’re stating that the trust has been removed with apples plans. This is an emotional response, because logic states that without present source code to scrutinise, one has only ever taken apples words on this trust. Nothing here has changed.

Everything else is whataboutism, emotionally charged false logic and slippery slope fallacy.

Client side doesn't have any privacy at all no matter how much you claim it does, it's wide open to seeing anything. iCloud stuff or not. And yes, Apple lost my trust by putting the scanner client side, and yes, trust is an emotion, big deal, it's based on analyzing what can be done client-side vs. server side and Apple losses.

 

[pdoherty]

How can they legally get away with this in the first place?
I mean, police needs a warrant to get in my house, but Apple doesn't???

A point I’ve also made. This is what happens when government and law enforcement use private corps as an end-run around the Constitution. And, to some people, this somehow makes good sense…

The only solution is never ever use the camera of the iPhone, and buy a digital one from Nikon or Canon or the like.
Even better pics.Win-win.

Oh wait, that's what all bandits do anyway.

Just like the “security theater” TSA that’s never stopped anyone, this too is simply more invasiveness for the sake of acting like it’s doing something useful.

No warrant required if you give permission, if you download ios15 then you have given permission

So, if a private company has you agree to an EULA that says you are prevented from expressing yourself (free speech) is that similarly binding? How many Constitutionally-protected rights or privacy do you think can be signed away? Is there a limit?

 

[cupcakes2000]

Client side doesn't have any privacy at all no matter how much you claim it does, it's wide open to seeing anything. iCloud stuff or not. And yes, Apple lost my trust by putting the scanner client side, and yes, trust is an emotion, big deal, it's based on analyzing what can be done client-side vs. server side and Apple losses.

Are you joking? Do you know what client side means verses server side? I highly doubt you do know becuase you lack an absolutely fundamental understanding it and the differences between the two.

I’m not claiming anything, I’m stating facts and reiterating the de facto preferred methods of the privacy minded.

 

[pdoherty]

Everybody knows this by now. But whatever is in their database I cannot verify. Part of the problem it could be not only child porn and matches can be triggered with manipulated hashes it seems.

Same as the ”no fly list”:

1. Secret list with no published criteria to be put on it
2. No individual body authorized to place/remove people from the no fly list
3. No way to find out if you’re on the list except to try and fly
4. No process to appeal being wrongly/unjustly put on the no fly list

 

[cupcakes2000]

Same as the ”no fly list”:

1. Secret list with no published criteria to be put on it
2. No individual body authorized to place/remove people from the no fly list
3. No way to find out if you’re on the list except to try and fly
4. No process to appeal being wrongly/unjustly put on the no fly list

1- of course it’s a secret database. It’s a database of child abuse photographs.
2- they have outlined this in their white paper.
3- if you have any doubt as to whether you have any images that are on this list then you’re the person it’s designed to catch.
4- You have absolute no knowledge of whether this statement is true or false, it’s just a made up sentance by you.

Try reading this - I’m not asking you to change your mind or opinion on it, but at least reading it will enable you to have informed opinion on the matter, instead of just making things up.

https://www.apple.com/child-safety/pdf/Security_Threat_Model_Review_of_Apple_Child_Safety_Features.pdf

 

[hagar]

Everybody knows this by now. But whatever is in their database I cannot verify. Part of the problem it could be not only child porn and matches can be triggered with manipulated hashes it seems.

The system is designed so that a user need not trust Apple, any other single entity, or even any set of possibly colluding entities from the same sovereign jurisdiction (that is, under the control of the same government) to be confident that the system is functioning as advertised,” Apple said.

First, Apple said it generated a CSAM device database by combining information from two separate child-safety agencies.

“Any perceptual hashes appearing in only one participating child-safety organization’s database, or only in databases from multiple agencies in a single sovereign jurisdiction, are discarded by this process, and not included in the encrypted CSAM database that Apple includes in the operating system,” Apple’s document explained. “This mechanism meets our source-image correctness requirement.”

Apple also specified that the database is never updated or shared over the internet.

 

[rme]

3- if you have any doubt as to whether you have any images that are on this list then you’re the person it’s designed to catch.

We're fully aligned today brother. People who doubt belong in prison!

4- You have absolute no knowledge of whether this statement is true or false, it’s just a made up sentance by you.

Right on. And whistleblowers and people who believe what they say should be sent there too.

Update: I just had a brilliant idea. Why don't we create special region for these doubters and "human rights" nutcases? How about Cupjiang Autonomous Region?

 

[cupcakes2000]

The system is designed so that a user need not trust Apple, any other single entity, or even any set of possibly colluding entities from the same sovereign jurisdiction (that is, under the control of the same government) to be confident that the system is functioning as advertised,” Apple said.

First, Apple said it generated a CSAM device database by combining information from two separate child-safety agencies.

“Any perceptual hashes appearing in only one participating child-safety organization’s database, or only in databases from multiple agencies in a single sovereign jurisdiction, are discarded by this process, and not included in the encrypted CSAM database that Apple includes in the operating system,” Apple’s document explained. “This mechanism meets our source-image correctness requirement.”

The company added that the database is never updated or shared over the internet.

Ohhhh you, stop it with your facts! Here we just like to form opinions based on whatever we feel like!

 

[cupcakes2000]

Right on. And whistleblowers and people who believe what they say belong in prison too.

Again, scare speech based on nothing but hot air. Let’s talk about what really matters here:
Apple has created a client side system whereby photos on a tamperproof (by all reasonable expectations by todays standards) database are hash matched against photos you have in your device, when you intend to place the photographs in apples server, iCloud.
That’s it.
Trust can’t be verified. But it never could be verified. They are, however going to extraordinary lengths to make this so you don’t, in actual fact, need to trust Apple. One of these things is the very fact it’s on device scanning verses server side scanning.

 

[iFisherman]

I guess my issue with this is as such; and someone feel free to point out how I am wrong, but won’t this just embolden hackers?

“Hi, I am hacker-x. I now have access to your iPhoto library. Unless you transfer $500 to this account in the next hour, I will be uploading kiddie fiddler images to your photo library that will get you arrested. If you don’t pay, have fun losing your livelihood, your freedom and all the money you will spend on attorneys fighting these charges. Oh, and have fun getting shived in prison because they treat child molesters great there!”

I know people have concerns about this being abused by an overly watchful government, and rightfully so, but the possible hacker aspect concerns me more.

 

[pdoherty]

1- of course it’s a secret database. It’s a database of child abuse photographs.
2- they have outlined this in their white paper.
3- if you have any doubt as to whether you have any images that are on this list then you’re the person it’s designed to catch.
4- You have absolute no knowledge of whether this statement is true or false, it’s just a made up sentance by you.

Try reading this - I’m not asking you to change your mind or opinion on it, but at least reading it will enable you to have informed opinion on the matter, instead of just making things up.

Oh, so I’m “making things up”?

Know Your Rights | What to Do If You Think You're on the No Fly List | ACLU

www.aclu.org

If you are a U.S. citizen or lawful permanent resident, and the TSC determines that you are on the No Fly List, DHS TRIP will send you a letter informing you of your status on the No Fly List and providing the option to submit and receive additional information. If you choose that option, DHS TRIP will provide a second letter identifying the general criterion under which you have been placed on the No Fly List and possibly including an unclassified summary of the reasons for your inclusion on the list. You should know that the government’s summary likely will not include all of its reasons for your placement on the list, and in some cases the government will choose not to provide any summary at all. The government also will not provide you any of the evidence it relied upon in deciding to place you on the list, and it may also withhold information in its possession that undercuts its basis for putting you on the list. Finally, the government does not provide a live hearing at which you could testify or give you an opportunity to cross-examine witnesses against you.

 

[scvrx]

It’s much easier to have a serious discussion if you actually engage in one instead of just promoting sensational headlines and buzzwords. There is plenty to be discussed, one would think with such passion displayed, yet nothing is being discussed, just dismissed out of hand.

There is nothing to be discussed. One of prerequisite of discussion is for the both sides to have rationality as an equalizer.

“Never argue with an idiot. They will drag you down to their level and beat you with experience.”​

― Mark Twain

 

[hagar]

Same as the ”no fly list”:

1. Secret list with no published criteria to be put on it
2. No individual body authorized to place/remove people from the no fly list
3. No way to find out if you’re on the list except to try and fly
4. No process to appeal being wrongly/unjustly put on the no fly list

There is no no fly list.

The list of CSAM content consists of photos from multiple child protection organisations. Only if the image is on all their lists, it’s included in the DB. so, it’s a good thing no individual organisation is responsible.

if your iCloud account is reported to NCSEM (not the authorities by the way) I assume they will decide if they will file a complaint against you, after which the legal authorities take over, which obviously includes a procedure for you to defend yourself.

there is no Apple police dragging you to jail.

 

[cupcakes2000]

I guess my issue with this is as such; and someone feel free to point out how I am wrong, but won’t this just embolden hackers?

“Hi, I am hacker-x. I now have access to your iPhoto library. Unless you transfer $500 to this account in the next hour, I will be uploading kiddie fiddler images to your photo library that will get you arrested. If you don’t pay, have fun losing your livelihood, your freedom and all the money you will spend on attorneys fighting these charges. Oh, and have fun getting shived in prison because they treat child molesters great there!”

I know people have concerns about this being abused by an overly watchful government, and rightfully so, but the possible hacker aspect concerns me more.

How is a hacker suddenly going to be access your phone due to this new function?

Oh, so I’m “making things up”?

Know Your Rights | What to Do If You Think You're on the No Fly List | ACLU

www.aclu.org

You’re equating one completely unrelated thing to another with no evidence to remotely do so. Yes. You’re making things up.

 

[rme]

There is no no fly list.

I'm sure you're right. Can you please inform the TSA of their mistake? https://www.tsa.gov/travel/passenger-support/travel-redress-program

 

[bobcomer]

Are you joking? Do you know what client side means verses server side? I highly doubt you do know becuase you lack an absolutely fundamental understanding it and the differences between the two.

I’m not claiming anything, I’m stating facts and reiterating the de facto preferred methods of the privacy minded.

Not joking at all. I'm an IT Manger that came from the developer ranks, I know what can happen with on device code and I know I wont be able to see it happening. You are stating *no* facts, it's only your misguided opinion.

 

[Mega ST]

Can you please inform the DHS of their mistake?

You mean a government list? Apple is not the government.

It's not that people don't understand it it's that people don't want private device default surveillance by companies.