University Researchers Who Built a CSAM Scanning System Urge Apple to Not Use the 'Dangerous' Technology

[jseymour]

The CSAM Detection system is very bad at scanning for weapons.

I don't see why that would necessarily be so? I worked on vision inspection systems that could identify features and anomalies a darn sight smaller even than a small handgun, over the length and breadth of something somewhat larger than the average human being. Admittedly, that was over an object that was supposed to have a certain set of known/desirable characteristics, but that was also with processing power significantly less than what's available today.

 

[jseymour]

Ran into this video this morning.
Check out the time stamp 11:40

I guess ol' Tim has changed his stance just a bit.

 

[Mercury7]

Ran into this video this morning.
Check out the time stamp 11:40

I just can’t see how he squares that with what he is doing… bizarre, he just doesn’t get it, I was watching Mac break weekly and they seemed to all agree that the solution is to have separate servers that do the hash comparisons after the photos have left the device….but they were also very skeptical Apple would do that because they are so full of themselves… they just think they are right and we are wrong

 

[ececlv]

Again, scare speech based on nothing but hot air. Let’s talk about what really matters here:
Apple has created a client side system whereby photos on a tamperproof (by all reasonable expectations by todays standards) database are hash matched against photos you have in your device, when you intend to place the photographs in apples server, iCloud.
That’s it.
Trust can’t be verified. But it never could be verified. They are, however going to extraordinary lengths to make this so you don’t, in actual fact, need to trust Apple. One of these things is the very fact it’s on device scanning verses server side scanning.

I dont want my phone calling the cops on me. Not sure why that is hard to understand

 

[09872738]

Ran into this video this morning.
Check out the time stamp 11:40

To paraphrase a german politician: What do I care about the rubbish I talked yesterday

 

[JBGoode]

I dont want my phone calling the cops on me. Not sure why that is hard to understand

It seems that you're the one who doesn't understand anything about this if you think your phone is going to call the cops on you. It's this type of ridiculous **** that only hurts your side of the argument.

 

[hans1972]

I don't see why that would necessarily be so? I worked on vision inspection systems that could identify features and anomalies a darn sight smaller even than a small handgun, over the length and breadth of something somewhat larger than the average human being. Admittedly, that was over an object that was supposed to have a certain set of known/desirable characteristics, but that was also with processing power significantly less than what's available today.

NeuralHash is designed to do two things at the same time:

A. (Indirectly) Finding images which are (close) exact copies of images in a database
B. Exceptional good at not finding any other images even if similar

It's part B which makes it so bad to use for governments.

1. The government takes 10 000 pictures of a weapons
2. Forces Apple to hash those photos
3. Forces Apple to put those hashes into the hash list and deploy a new version of the iOS
4. User has 100 images of his weapons
5a. User uses iCloud Photo Library
5b. The government forces Apple to scan the whole device
6. The CSAM Detection should turn up zero of those weapon images as matches

So many people won't believe #6.

 

[scvrx]

Message to obvious Applelogist and Cultists here:
1. You can sleep well. Apple will break sells records. Again. You-tubers and influencers are producing interest as we speak. Mindless masses want to feel successful and this is the easy way.
2. Screeching voices of rationally thinking minority with actual technical expertise are already leaving "the ecosystem". So you will live happily with your corporate defined echo-chamber and will give your money to Apple with pleasure.
3. In the long term all self-respected businesses will abandon Apple as a daily business driver and will search alternatives with real privacy.
4.The proposed EU attacks towards encryption will amount to nothing more than surveillance of people who cannot be bothered to care about privacy - those who have nothing to hide. Business will find a way to circumvent those measures.
5.There is a way if you decide to grow up and decide to live in the real world, not in some imaginary Apple Metaverse in which monopolistic corporation paints the colourful picture and pinky swears not to abuse your life. It is called FOSS.
It is not for everyone. It is for those who can put the effort for retaining control over their privacy and digital life.
6. There is no conspiracy. The absence of reaction by Tim Apple speaks volumes for those who know how corporations work internally. This is planned and aside of PR miscalculation, this will see the light of the day.
7. Face it. From this moment on, trust in public image of Apple as a guardian of privacy is over. Gone. Whataboutism or Applelogism will not restore it back.
8. For smarter audience the charm of "shiny toys with empty promises" is over. Apple is now for stupid people.
9. Stupid people are the biggest market ever. Apple will become intergalactic corporation loved by every government on the planet.
10. But some of us will say to Apple :

Goodbye and Thanks for All the Fish​

 

[hans1972]

I think this is a major concern for many in Europe. Not only apple might not meet EU regulations but any business user might violate data handling and privacy protection requirements by allowing separate stuff and searching to happen within his private data and device. Yes I know, set iCloud to off and you are fine and such and it's announced for the US market first only, but this is not ending here and might very well be rolled out over platforms and countries and such finally with more punch.

If it's illegal in EU, Apple won't deploy it there.

But the EU-parliament voted just early this summer to give wide powers to companies to search for CP, basically carving out an exception from GDPR.

 

[jseymour]

...
6. The CSAM Detection should turn up zero of those weapon images as matches

So many people won't believe #6.

I understand your reasoning. I'm not 100% certain I agree with your conclusion. But I'm way out of the loop in image processing. It was many, many moons ago I worked in that field.

 

[hans1972]

Apologies, perhaps I didn't express what I meant by, "This forum is an echo-chamber for people who drank the koolaid and already love Apple products." -- My point was that this is an Apple forum. Nearly everybody here already likes/loves Apple and their products.

And this: "I'm seeing plenty of people who range from "this makes me uncomfortable" to "I'm outta here.""

Was exactly my point. Apple is alienating their core customer base who usually feel they can do no wrong (including me, I agree with you).

Nope, a lot of people have disled Apple ever since Cook took over, or they cut removable battery , or removable disk, or removable RAM, or USB-A, or SD-card reader; or its too expensive, or there are no NDIVDIA graphics card; or CUDA support; or they aren't paying enough taxes; or they're monopoly; or taking too much commission from developers; or you can't side load; or Apple tax;

There are so many forum members who have been dissatisfied with almost everything Apple does for nearly a decade.

 

[citysnaps]

Since your phone includes more information about yourself than iCloud does, any scanner has more access than if they just scanned server side. And since it's down on your device, iCloud is irrelevant now, and it's oh so easy to change what is scanned without most users even knowing about it.

Oh so easy to change what is scanned ? By who? And how? With a signed OS? Oh so easy?

 

[RobArtLyn]

Oh so easy to change what is scanned ? By who? And how? With a signed OS? Oh so easy?

Obviously easy for the signer of the OS, who is not trusted by the person to whom you are replying.

 

[citysnaps]

Obviously easy for the signer of the OS, who is not trusted by the person to whom you are replying.

Oh... So you believe Apple will be going on a secret fishing expedition finding all sorts of juicy stuff scanning the phones of their 1 billion customers?

And do what with all that collected juicy stuff?

Such an easy secret to keep, right? No consequences if that fishing expedition were leaked, right? And so good for business.

Jeez, Apple could have done this years ago. Maybe they have, do you suspect?

 

[beerseagulls]

NeuralHash is designed to do two things at the same time:

A. (Indirectly) Finding images which are (close) exact copies of images in a database
B. Exceptional good at not finding any other images even if similar

It's part B which makes it so bad to use for governments.

1. The government takes 10 000 pictures of a weapons
2. Forces Apple to hash those photos
3. Forces Apple to put those hashes into the hash list and deploy a new version of the iOS
4. User has 100 images of his weapons
5a. User uses iCloud Photo Library
5b. The government forces Apple to scan the whole device
6. The CSAM Detection should turn up zero of those weapon images as matches

So many people won't believe #6.

can't wait...

1. Apple has billions in cash
2. false positive causes me to lose my current job
3. professional reputation ruined
4. my attorney(Jackie) files $10 million lawsuit on my behalf(30 times my annual income)
5. Apple settles for [undisclosed] amount. Attorney Jacke takes his usual cut.
6. move into my new 150-foot yacht and circle the globe for the next 15 years.
7. Thank you, Apple.

 

[bobcomer]

Oh so easy to change what is scanned ? By who? And how? With a signed OS? Oh so easy?

By Apple, of course. And with a signed hash -- it's call an update. Duh.

 

[dk001]

It’s not their database. Also, you do not know what a fisa warrant is, clearly.

This is incorrect, photos are not end to end encrypted on iCloud.

This is simply a hugely incorrect statement. Ignorance like this is exactly why people really need to read up on subjects they know nothing about, instead of just jumping on the bandwagon because they think they know things.

You apparenbtly do not understand what my tongue in cheek attempt was.
While not totally accurate, it catches the “feeling” of the issue.

 

[citysnaps]

By Apple, of course. And with a signed hash -- it's call an update. Duh.

So Apple is going to go on a fishing expedition poking around in every nook and cranny of your phone seeking out your private and personal information - by changing what is scanned, as you put it? And then what? What will they do with that juicy stuff?

Maybe they've already been doing that for the last ten years?

 

[dk001]

It’s much easier to have a serious discussion if you actually engage in one instead of just promoting sensational headlines and buzzwords. There is plenty to be discussed, one would think with such passion displayed, yet nothing is being discussed, just dismissed out of hand.

The problem is that your current stance does lay claim to “ready to openly and honestly discuss”.
Start a new thread. I am more than willing to discuss.

 

[Abazigal]

Since your phone includes more information about yourself than iCloud does, any scanner has more access than if they just scanned server side. And since it's down on your device, iCloud is irrelevant now, and it's oh so easy to change what is scanned without most users even knowing about it.

Real life is not a mission impossible movie.

 

[dk001]

Are you joking? Do you know what client side means verses server side? I highly doubt you do know becuase you lack an absolutely fundamental understanding it and the differences between the two.

I’m not claiming anything, I’m stating facts and reiterating the de facto preferred methods of the privacy minded.

Are you talking device data or webpages?
One is correct in use (mostly) the other is not.

 

[dk001]

1- of course it’s a secret database. It’s a database of child abuse photographs.
2- they have outlined this in their white paper.
3- if you have any doubt as to whether you have any images that are on this list then you’re the person it’s designed to catch.
4- You have absolute no knowledge of whether this statement is true or false, it’s just a made up sentance by you.

Try reading this - I’m not asking you to change your mind or opinion on it, but at least reading it will enable you to have informed opinion on the matter, instead of just making things up.

https://www.apple.com/child-safety/pdf/Security_Threat_Model_Review_of_Apple_Child_Safety_Features.pdf

I wish people would get this right. It is not secret. It is illegal for anyone other than specific groups to own.

 

[dk001]

I guess my issue with this is as such; and someone feel free to point out how I am wrong, but won’t this just embolden hackers?

“Hi, I am hacker-x. I now have access to your iPhoto library. Unless you transfer $500 to this account in the next hour, I will be uploading kiddie fiddler images to your photo library that will get you arrested. If you don’t pay, have fun losing your livelihood, your freedom and all the money you will spend on attorneys fighting these charges. Oh, and have fun getting shived in prison because they treat child molesters great there!”

I know people have concerns about this being abused by an overly watchful government, and rightfully so, but the possible hacker aspect concerns me more.

It is a new avenue into the Apple systems, iOS, iPadOS, and MacOS.
Will it attract potential hackers? Likely.
How effective they are, TBD.

 

[bobcomer]

So Apple is going to go on a fishing expedition poking around in every nook and cranny of your phone seeking out your private and personal information - by changing what is scanned, as you put it? And then what? What will they do with that juicy stuff?

Maybe they've already been doing that for the last ten years?

Whatever the governments "ask" them to do with it. This just makes it easier to comply, but yes, I would be surprised if they didn't fork over info given what they want to do now, it all follows.

 

[bobcomer]

Real life is not a mission impossible movie.

Never said it was, or that I was worried about what info they would gain from me, I'm as boring as they come. It's the precedent. They said they were for privacy, yet this is the biggest privacy violation that can happen.