Become a MacRumors Supporter for $50/year with no ads, ability to filter front page stories, and private forums.
That’s why I am seeing all kinds of professionals pushing against this not to mention over 90 civil rights groups and a significant chunk of Apple employees. :rolleyes:

Love to see open honest peer review of this functionality.
Agreed. And I will push back on it too if it’s as dangerous as it has potential to be. However, that has yet to be proven. Until then, I’m no bandwagon jumper. I’m certainly not throwing all my Apple stuff in the bin and cancelling every sub based on speculation 😂

Edit: ‘Apple employees’ is a broad term. My mate works in an Apple Store. If he says he doesn’t like it does that actually prove anything?
 
Correct. So why not just continue not having E2E encryption on iCloud photos and scan them before encrypting them into storage?
Because then you can’t access the photos using your web browser?
Because then Apple is being MORE invasive?
Because the current method actually would allow for E2E encryption of photos in the future if Apple chose to implement it?
Because scanning on the server side is more opaque, and could easily be modified and NO ONE would ever know unless Apple told them, where as on device scanning can be audited by outside security experts?

You are arguing in favor of a more invasive, more opaque, less privacy respecting system. It’s clear you haven’t bothered to put in even a minimal amount of effort to understand what Apple is actually doing and the various factors surrounding it. Next time why don’t you educate yourself before posting inaccurate and uniformed comments.
 
Because then you can’t access the photos using your web browser?
Okay, so, if they're not going to encrypt them at all, what is the point of this entire exercise? (Btw: Please see: iCloud security overview.)

Because then Apple is being MORE invasive?
In your opinion. I disagree. (Obviously)

Because the current method actually would allow for E2E encryption of photos in the future if Apple chose to implement it?
As I outlined in another post: They can be E2E-encrypted w/o installing spyware on users devices.

Because scanning on the server side is more opaque, and could easily be modified and NO ONE would ever know unless Apple told them, where as on device scanning can be audited by outside security experts?
Trade-off. Conversely, I can avoid server-side scanning entirely by not using the cloud.

It’s clear you haven’t bothered to put in even a minimal amount of effort to understand what Apple is actually doing and the various factors surrounding it.
It's clear you're making unwarranted assumptions. I understand perfectly well how the proposed system works. Understanding it is precisely why I object to it.

That "they object to it because they don't understand it" argument has been tried numerous times. It's old and tired.

Next time why don’t you educate yourself before posting inaccurate and uniformed comments.
You'd be wise to give that advice to the individual you see in the mirror next time you look. (See, e.g.: Your first point and my response.)
 
Last edited:
  • Like
Reactions: dk001
One flaw in this is that this implementation only checks for known CSAM. But, this is the first step to Apple fully scanning photos on device because version 2 of this will need to check for both known and unknown.

Then, once they implement version 2 of this, it can then be used to scan all of your photos for whatever local governments want.

Apple used to tell governments stuff like this wasn’t possible. Now it is possible and now that the governments know, this could keep evolving.

Apple needs to stop this now; but I doubt they will. This should have never been an option. I’m happy people are still talking about this and I hope that the discussion continues.
 
Agreed. And I will push back on it too if it’s as dangerous as it has potential to be. However, that has yet to be proven. Until then, I’m no bandwagon jumper. I’m certainly not throwing all my Apple stuff in the bin and cancelling every sub based on speculation 😂

Edit: ‘Apple employees’ is a broad term. My mate works in an Apple Store. If he says he doesn’t like it does that actually prove anything?
Well it is a certainty they are installing software on your devices to scan them for illegal content, regardless of implementation that is a fact… so if that does not bother you then your right that you shouldn’t jump on the bandwagon…. I think most of us who have jumped are simply not ok with it
 
Well it is a certainty they are installing software on your devices to scan them for illegal content, regardless of implementation that is a fact… so if that does not bother you then your right that you shouldn’t jump on the bandwagon…. I think most of us who have jumped are simply not ok with it
It’s in the details though. Surely. Scan = bad, and that’s the limit of your thoughts. It’s not black and white however. It’s Apple getting in line with any other cloud provider, yet doing it in a more privacy focussed manner. The papers outline how, and when released the audits should prove it. Until then everything you’re basing your wildly conspiracy based theories on is just rumour and conjecture
You can’t see that, obviously - as your comments show. But that doesn’t mean it isn’t true.
 
  • Like
Reactions: JBGoode
And you seem to be unable to notice how different it is to scan private end user devices BEFORE you store the pictures on apple's servers. This IS true.
 
I want nothing to do with child porn. I don't want it on my devices and I also don't want a database of child porn fingerprints on my devices either. I consider that fingerprint database almost as repulsive to possess as the actual pictures as it is a derivative of that content. According to Apple this database will be stuff everyone unambiguously considers child porn and that means the worst of the worst. This won't be images of underage teens but much younger than that. Really vile stuff.

If Apple wants to do a prescan before uploading to their servers make the prescanner a module that can be downloaded and installed solely for that purpose and that will be verifiably uninstalled when not uploading to iCloud. If I don't upload to iCloud, the data will not exist on my device at all.
 
Last edited:
  • Like
Reactions: Euronimus Sanchez
And you seem to be unable to notice how different it is to scan private end user devices BEFORE you store the pictures on apple's servers. This IS true.
That difference is the crucial and privacy focussed important part.
Or else they run whatever they want on their server scanning whatever they like of your stuff and it’s out of you control. they can easily be compromised by any agency with a gag order, or hacked unknown to them. That cannot happen in anywhere the same manner as if the scanning is done on your own device. The hashes are updated within the signed os, and they’ll be able to be verified. It’s massively privacy focussed. ‘Scanning device’ is the wording that everyone has freaked out about. But that’s not entirely what is happening.

I want nothing to do with child porn. I don't want it on my devices and I also don't want a database of child porn fingerprints on my devices either. If find that fingerprint database almost as repulsive to possess as it is a derivative of that content.
You have massively misunderstood what is happening and how it will happen.
 
  • Haha
Reactions: dk001
Apple is listening though, as one of my comments has been addressed, which explains why I gave the hash database
I am disagreeing with these two statements:

"However the 4th Amendment interpretation is rather different to how it was envisaged when it was created, and where the USA and no doubt other countries have found a way to circumvent privacy laws, so they can shout from the rooftop about safeguarding privacy, whilst driving a coach and horses through it, FOR ANY PURPOSE, so its not about child abuse."

"With regards to the USA they are doing this because the 4th Amendment after Court rulings decided that you can circumvent the privacy enshrined in the 4th Amendment because they deem it ONLY APPLIES TO GOVERNMENT ACTION BUT DOES NOT CONSTRAIN PRIVATE PARTIES"

The 4th amendment was envisaged to only apply to the federal government in 1791.
The 4th amendment was envisaged to not apply to private companies, both in 1791 and in 2021. Nothing has changed.

No court rulings can have decided that the 4th amendment only applies to government actions since it has been that way since 1791.
No court rulings can have decided that the 4th amendment doesn't constrain private parties (including private search) since it has been that way since 1791.

At best these court cases can only have confirmed a long standing practise.

The cases you refer to have dealt with the issue of how much search a government party can do after a private search before needing a search warrant.

NCMEC was considered a government agent in United States vs. Ackerman.
Again without intending disrespect you seem to be swivelling all the time and then changing what you are complaining about after getting everything else wrong.
I am disagreeing with these two statements:

"However the 4th Amendment interpretation is rather different to how it was envisaged when it was created, and where the USA and no doubt other countries have found a way to circumvent privacy laws, so they can shout from the rooftop about safeguarding privacy, whilst driving a coach and horses through it, FOR ANY PURPOSE, so its not about child abuse."

"With regards to the USA they are doing this because the 4th Amendment after Court rulings decided that you can circumvent the privacy enshrined in the 4th Amendment because they deem it ONLY APPLIES TO GOVERNMENT ACTION BUT DOES NOT CONSTRAIN PRIVATE PARTIES"

The 4th amendment was envisaged to only apply to the federal government in 1791.
The 4th amendment was envisaged to not apply to private companies, both in 1791 and in 2021. Nothing has changed.

No court rulings can have decided that the 4th amendment only applies to government actions since it has been that way since 1791.
No court rulings can have decided that the 4th amendment doesn't constrain private parties (including private search) since it has been that way since 1791.

At best these court cases can only have confirmed a long standing practise.

The cases you refer to have dealt with the issue of how much search a government party can do after a private search before needing a search warrant.

NCMEC was considered a government agent in United States vs. Ackerman.
Ackerman is certainly interesting but sadly none of these cases actually matter too much any more because as a result of good faith exceptions now, even if a party is private the good faith exception can apply. So basically you are not safe from any real surveillance, private or otherwise, but the cases are interesting and thank you for bringing Ackerman to the table. It probably bores the pants of most people, but like all laws subject to differences in interpretation and of course where for example arguments on whether a body is private or not, no longer really safeguards, because of the good faith exceptions, which is even more worrying for privacy issues.


"Ackerman filed a motion to suppress. He argued that both AOL and NCMEC were government actors and that their searches violated his Fourth Amendment rights. See R1.13. The district court denied Ackerman’s motion following an evidentiary hearing. See United States v. Ackerman, No. 13-10176-01-EFM, 2014 WL 2968164, at *1 (D. Kan. July 1, 2014). The court concluded that neither AOL nor NCMEC were government actors. See id. at *5–8. It also concluded that—even if NCMEC was a government actor—NCMEC’s search did not exceed the scope of AOL’s search in a “constitutionally significant” way. See id. at *8–10. Following the denial, Ackerman pleaded guilty but reserved his right to appeal the district court’s denial of his motion to suppress."

"The court concluded that neither AOL nor NCMEC were government actors."
It was interesting though that on appeal this decision was reversed:
" On appeal, we reversed and held that NCMEC is a government actor and NCMEC conducted a search."."

However although he won that it was ruled that the held that NCMEC was an agency but had good-faith exception, so its rather pointless and makes no difference to the situation, which is still su?


If you look at the base of the judgement though which is a common denominator.
"This order and judgment is not binding precedent, except under the doctrines of law of the case, res judicata, and collateral estoppel. It may be cited, however, for its persuasive value consistent with Fed. R. App. P. 32.1 and 10th Cir. R. 32.1. FILED United States Court of Appeals Tenth Circuit February 26, 2020Christopher M. Wolpert Clerk of Court"

Lichtenberger, 786 F.3d at 483-8 is a case from 2015.
The USA v Miller was only filed and decided in December 2020, so there the 4th has clearly had a different opinion
I am disagreeing with these two statements:

"However the 4th Amendment interpretation is rather different to how it was envisaged when it was created, and where the USA and no doubt other countries have found a way to circumvent privacy laws, so they can shout from the rooftop about safeguarding privacy, whilst driving a coach and horses through it, FOR ANY PURPOSE, so its not about child abuse."

"With regards to the USA they are doing this because the 4th Amendment after Court rulings decided that you can circumvent the privacy enshrined in the 4th Amendment because they deem it ONLY APPLIES TO GOVERNMENT ACTION BUT DOES NOT CONSTRAIN PRIVATE PARTIES"

The 4th amendment was envisaged to only apply to the federal government in 1791.
The 4th amendment was envisaged to not apply to private companies, both in 1791 and in 2021. Nothing has changed.

No court rulings can have decided that the 4th amendment only applies to government actions since it has been that way since 1791.
No court rulings can have decided that the 4th amendment doesn't constrain private parties (including private search) since it has been that way since 1791.

At best these court cases can only have confirmed a long standing practise.

The cases you refer to have dealt with the issue of how much search a government party can do after a private search before needing a search warrant.

NCMEC was considered a government agent in United States vs. Ackerman.
Hans. First of all thanks for mentioning the United States vs. Ackerman as it is useful.

If anything it assists my 'the 4th Amendment interpretation is rather different to how it was envisaged when it was created" which is correct.

As in most law interpretation changes and with technological change its not surprising.

One of the first cases suggesting that "A search or seizure carried out by a private individual, even if it is unreasonable, DOES NOT implicate the Fourth Amendment" United States v. Jacobsen, 466 U.S. 109, 113 (1984).

Which is in line with my comments.

Then we have the milestone:
"The right of the people to be free from unreasonable searches and seizures proscribes only governmental action; it is wholly inapplicable “to a search or seizure, even an unreasonable one, effected by a private individual not acting as an agent of the Government or with the participation or knowledge of any governmental official.”
Walter v. United States, 477 U.S. 649, 662 (1980)."

PRIVATE CITIZEN OR GOVERNMENT AGENT?
Although a wrongful search or seizure conducted by a private party does not violate the fourth amendment, a private citizen’s actions may in some instances be considered state action.
Coolidge v. New Hampshire, 403 U.S. 443, 487 (1971).
GENERAL PRINCIPLE:
Determining the existence of an agency relationship between the Government and the private party conducting the search turns on the degree of the Government’s involvement in the private party’s activities. This is done on a case-by-case basis, viewing the totality of circumstances.
Skinner v. Railway Labor Executives’ Ass’n, 489 U.S. 602, 614-15 (1989).

So you see the 4th has had to evolve.

However, what is interesting in the case you raised, was this contrary to the USA v Miller case


The USA v Miller case is stated to have been decided and filed 3 December 2020
A private party who searches a physical space and hands over paper files to the government has not violated the Fourth Amendment. Burdeau v. McDowell, 256 U.S. 465, 475 (1921). That rule covers Google’s scan of virtual spaces and disclosure of digital files.

In that case United States v. Jacobsen, 466 U.S. 109, 119 (1984) was cited and indeed even the United States v Ackerman, the case you mention.

What's interesting in the Miller case also is it mentions "2. Did Google act under compulsion, meaning if it did it would be then treated as if it were a government act Blum, 457 U.S. at 1004; see Adickes v. S. H. Kress & Co., 398 U.S. 144, 170–71 (1970).

The Miller case specifically mentions NCMEC and hashes:
"But the Fourth Amendment restricts government, not private, action."

"Miller argues that these activities create a nexus with the government because he asks us to treat NCMEC, a private entity, as a government actor. The Tenth Circuit viewed NCMEC in that light. Ackerman, 831 F.3d at 1295–1300. "

Now for a crucial part of your Ackerman case, which ironically makes all of it a moot point because of the following:
"The court also ruled that even if the government violated Ackerman’s Fourth Amendment rights, suppression of evidence was unwarranted due to the good faith exception"

So basically the 4th amendment means very little now in terms of safeguarding privacy, as even ruling a party is private traditionally outside the scope of 4th Amendment, the Good Faith exception is used anyway!

So even if NCMEC are agreed to be a government actor, they've just used a good faith exception instead.
So its actually an irrelevance to the Apple case, because originally the argument always appeared to be whether


No. 18-5578United States v. MillerPage 3government has not violated the Fourth Amendment. Burdeau v. McDowell, 256 U.S. 465, 475 (1921). That rule covers Google’s scan of virtual spaces and disclosure of digital files.

Just had a 40 minute power cut so I hope the post is ok.

Privacy wise, it would appear to some now you are damned if you do and damned if you don't, and why I am so vehemently against Apple introducing Software on our hardware rather than via the cloud.

It would appear thus far that these type of cases seem to be about data passing to ISP's or similar, not interrogating what is on your own hardware, which in my opinion is a slippery slippery slope.

I note too massive variation in statistics on the reliability of hashes, but where for me its got nothing to do with hashes, nothing to do with child abuse, but everything about Apple introducing surveillance on hardware, as if tools for the hash are on your hardware as others have described it, its a backdoor, open to all sorts of abuse.
 
  • Like
Reactions: Schismz and dk001
Apple confirmed to 9to5 that it has already been scanning iCloud email since 2019.

"Apple also indicated that it was doing some limited scanning of other data, but would not tell me what that was, except to suggest that it was on a tiny scale. It did tell me that the “other data” does not include iCloud backups."

 
As Apple seem to have confirmed they have been scanning iCloud mail for some time, there is no excuse then to place software on our hardware. They could scan iCloud Photos via their server, and I would not object to that.

"However, Apple confirmed to me that it has been scanning outgoing and incoming iCloud Mail for CSAM attachments since 2019. Email is not encrypted, so scanning attachments as mail passes through Apple servers would be a trivial task.

Apple also indicated that it was doing some limited scanning of other data, but would not tell me what that was, except to suggest that it was on a tiny scale. It did tell me that the “other data” does not include iCloud backups.

Although Friedman’s statement sounds definitive – like it’s based on hard data – it’s now looking likely that it wasn’t. It’s our understanding that the total number of reports Apple makes to CSAM each year is measured in the hundreds, meaning that email scanning would not provide any kind of evidence of a large-scale problem on Apple servers.

The explanation probably lays in the fact that other cloud services were scanning photos for CSAM, and Apple wasn’t. If other services were disabling accounts for uploading CSAM, and iCloud Photos wasn’t (because the company wasn’t scanning there), then the logical inference would be that more CSAM exists on Apple’s platform than anywhere else. Friedman was probably doing nothing more than reaching that conclusion."

Again this demonstrates there is no reason at all why Apple should not concentrate its efforts if it wishes on its server, not our hardware.

It is suggested they are now going to check on photos as they have not been scanning iCloud photos, so the fact they are then taking this opportunity to deviate from others in having this software originating on our hardware is unacceptable. Keep it on the iCloud, which is Apple's prerogative. It is not and should not be their prerogative to do do that on our hardware.

Going to hardware has massive ramifications.
 
The internet is awash with speculation. There can be no facts regarding the implementation until it’s released for people to see and for people to test properly.
Until then, no researcher worth their salt will say whether they support it or not. Of course, everyone will be able to state their distrust or dislike of the implementation, but all of that’s completely irrelevant until it’s actually in the hands of researchers and can be audited.

It’s really not a hard concept to grasp.
Please. We get it. Everything is honky-dory. We are the screeching voices of minority. Experts are not enough for you and people with your way of thinking. You don't work with reason, you are desperately trying to protect a badly designed system from mighty Apple.

You will ask why? I will reply: The parameters of this search of CSAM cannot be verified because of lack of access to those type of materials legally. This is ultimate man/private-corp/government attack. Apple designed the system and removed themselves from responsibility, furthermore the idea of on device processing is to normalize the upcoming AI tech who will be expanded without any doubt.

Lets not pretend here, that we as minority will make impact over this. This has political support and multi-corporation synchronization. Do your research outside Apple echo chamber. They are basically preparing for global digital control and suppression of information. Thats all.
Davos Elites have a vision and they command obedience from governments and multinational corporations.

Did I removed Apple from my business because I am stupid? Or did I lost two weeks in useless sharing of information?
We as old professionals must give you a warning. Thats all. Outside this, I personally don't have a need to be right or to win any debate. You are ignoring the warnings, and this is your choice. Lets move on.
apple.jpg
 
Last edited:
Do your research outside Apple echo chamber. They are basically preparing for global digital control and suppression of information
Global control? Because it’s only on US phones. There are substantially many more countries in the world than the US.
What basis are these claims on? What evidence do you have? You know Apple has just released a system whereby no one can know your ip address when browsing? Pretty much unheard of level of privacy from a mainstream company.

The paranoia here is quite something. New world order type conspiracy theories are really nothing new.
Time to get in your underground bunker in the forest with your guns ready - they’re coming man. I’m sure of it.
 
Agreed. And I will push back on it too if it’s as dangerous as it has potential to be. However, that has yet to be proven. Until then, I’m no bandwagon jumper. I’m certainly not throwing all my Apple stuff in the bin and cancelling every sub based on speculation 😂

Edit: ‘Apple employees’ is a broad term. My mate works in an Apple Store. If he says he doesn’t like it does that actually prove anything?

I should have been clearer. I was talking employees at One Apple Park Way….. Apple Store employees I have not seen anything concrete on their response.
 
Last edited:
Global control? Because it’s only on US phones. There are substantially many more countries in the world than the US.
What basis are these claims on? What evidence do you have? You know Apple has just released a system whereby no one can know your ip address when browsing? Pretty much unheard of level of privacy from a mainstream company.

The paranoia here is quite something. New world order type conspiracy theories are really nothing new.
Time to get in your underground bunker in the forest with your guns ready - they’re coming man. I’m sure of it.
Are you uninformed? There is no paranoia. There are plenty of legislations in EU to break encrypted chat. Tim Apple will visit The White House to discus cybersecurity. Multiple corporations (including DuckDuckGo, for my surprise) had recent conference, including Apple. There are legislations in process. But I will not do your homework, boy. If you are so active here may be you can do your own research.

Please don't respond to my comments.
 
  • Like
Reactions: jk1221
Theoretically speaking, they could stuff just about whatever signatures they wanted in there. There's disagreement as to the potential efficacy of such things as drugs, firearms, social settings, etc.
Well, as I have posted elsewhere, Apple doesn't decide the hashes, doesn't create the hashes. And that makes sense. Law enforcement, in this case NCMEC, and later the European equivalent I assume, provide the hashes of images that are then currently of the most interest, danger, circulation, etc.

However, in some countries homosexuality is illegal. Authorities could include a common Rainbow flag image. Likely won't catch all, but will catch some....And also demanded all hits are sent directly to the "Office of Inspection", bypassing Apple.

Of course that is NOT happening now. Yet, Apple has caved in China, as an example. Apple will cave again when it "becomes law" in the country it operates.
 
It is often stated Apple will allow independent review of this "feature". Following on from my comments about Apple making a complete and utter Hash of this announcement, that someone at Apple by now would have realised a list of independent reviewers would go a long way to alleviating concern.

Create a panel of experts, both pro and con, publish the list, and then for example, bi-annual security review . . . Someone far wiser once mentioned sunlight is the best disinfectant, electric light the best policeman.....

Is it sheer incompetence that Apple has not provided a list. Is Apple still on the back foot with respect to CSAM? Apple simply doesn't care? Of course we mere mortals do not know. Yet, I do find it telling.
 
  • Like
Reactions: zkap and BurgDog
I want nothing to do with child porn. I don't want it on my devices and I also don't want a database of child porn fingerprints on my devices either. I consider that fingerprint database almost as repulsive to possess as the actual pictures as it is a derivative of that content. According to Apple this database will be stuff everyone unambiguously considers child porn and that means the worst of the worst. This won't be images of underage teens but much younger than that. Really vile stuff.

If Apple wants to do a prescan before uploading to their servers make the prescanner a module that can be downloaded and installed solely for that purpose and that will be verifiably uninstalled when not uploading to iCloud. If I don't upload to iCloud, the data will not exist on my device at all.
A very good point.

I too do not want a database of child porn on my computer, my phone, my tablet.

And by placing it on my computer, I resent the explicit assumption that I am guilty, and need to be monitored.

Would it be too much of a stretch to compare this to an ankle bracelet?
 
Register on MacRumors! This sidebar will go away, and you'll see fewer ads.