It's terrifying that Apple is allowing the government to bypass legal restrictions that would have made this type of search unlawful. I am not defending criminals or pedos but I strongly object to the government having unlimited insight into the photos on personal devices. A list of hashes is exactly that, and that list could be expanded to anything the government would like as I strongly assume the the government is providing the hashes to Apple initially.
I must live a very boring life. There are no naked pictures of me out there and even if there were, nobody would want to see them. Other than banking details, which the government can access without my phone, getting into the hands of criminals there is nothing I would be concerned about if it made its way onto the front page of the NYTimes. The only people this is going to affect is child pornographers and pedophiles. Good riddance. Small positives are not going to be flagged so this is not going to affect innocent and legal users. For the paranoid, the safest and easy solution is don’t backup to iCloud though, save everything to local computers, backing those up locally and then saving a copy using encrypted backblaze service or something similar.
Professional photographers would be more likely than a common user to have some issue here or there, so perhaps them avoiding photo uploads to Apple might be a consideration. Otherwise, I don't see this as particularly problematic.
The only reason there's a significant uproar over this now is that Apple themselves created this whole "privacy is a core value" marketing plan they've been promoting for several years. They intentionally left the impression, whether entirely accurate or not, they had put up an impenetrable barrier that some Apple users now see them installing a doorframe in. The outcry is of Apple's own making IMHO.
It's terrifying that Apple is allowing the government to bypass legal restrictions that would have made this type of search unlawful. I am not defending criminals or pedos but I strongly object to the government having unlimited insight into the photos on personal devices. A list of hashes is exactly that, and that list could be expanded to anything the government would like as I strongly assume the the government is providing the hashes to Apple initially.
Oh yeah. It’s definitely a “we’re doing it for the kids!” thing that will later include more and more until all your photos belong to the government. We’ve seen the government do crap like this before. They want Apple’s tasty encrypted database.
BTW arresting pedos who have this content DOES NOT stop child abuse in any way. The abusers stay free, it’s just an excuse to put more people in jail, the children’s lives don’t benefit.
Yes, Apple is blocking and reporting prohibited content.
And, concerns about "where does it stop?" are valid.
Conversely, in the current climate of "We don't trust our government" (which is the arbiter social mores) where does it begin?
Should we let anything through?
Should we let nothing through?
Criminals, insurrectionists, sexual predators, terrorists and the like all depend on the "anything goes, we are a free, democratic country" mantra.
But, throughout its modern history the country has relied on social mores to police "free speech" to create a safe, stable society.
The question some ask is: "Should there be a line where something is prohibited?" The answer is: "That's a stupid question. For the protection of society from bad actors there must be a line.
The only valid question is: "Where should that line be drawn?"
... And that's an ongoing question that keeps changing as society evolves.
....... At one point, not too long ago, pictures of homosexual acts were more prohibited than those of sexual acts involving minors.
Should Apple be screening for terroristic content? But what is a terrorist? Do they have to wear a turban?
THEN you get to the question of "Who decides what should be prohibited and who enforces that prohibition?"
... Should it be private companies?
... Should it be the government?
... Should it be a coalition of both?
But that's the primary benefit of democracy: it can test out different theories and methods and (hopefully) find the right answer(s).
As Winston Churchill so correctly put it: "America always does the right thing -- after it tries everything else.
This probably also means eventually (if not already) Apple is scanning data that goes through iCloud Private Relay. Why try and force every ISP to scan people's data when they can by default pass it all through an Apple server? One hell of a lot easier to have a single point to collect data from.
It's terrifying that Apple is allowing the government to bypass legal restrictions that would have made this type of search unlawful. I am not defending criminals or pedos but I strongly object to the government having unlimited insight into the photos on personal devices. A list of hashes is exactly that, and that list could be expanded to anything the government would like as I strongly assume the the government is providing the hashes to Apple initially.
I must live a very boring life. There are no naked pictures of me out there and even if there were, nobody would want to see them. Other than banking details, which the government can access without my phone, getting into the hands of criminals there is nothing I would be concerned about if it made its way onto the front page of the NYTimes. The only people this is going to affect is child pornographers and pedophiles. Good riddance. Small positives are not going to be flagged so this is not going to affect innocent and legal users. For the paranoid, the safest and easy solution is don’t backup to iCloud though, save everything to local computers, backing those up locally and then saving a copy using encrypted backblaze service or something similar.
Professional photographers would be more likely than a common user to have some issue here or there, so perhaps them avoiding photo uploads to Apple might be a consideration. Otherwise, I don't see this as particularly problematic.
The only reason there's a significant uproar over this now is that Apple themselves created this whole "privacy is a core value" marketing plan they've been promoting for several years. They intentionally left the impression, whether entirely accurate or not, they had put up an impenetrable barrier that some Apple users now see them installing a doorframe in. The outcry is of Apple's own making IMHO.
Well, it won’t be problematic because Google will be doing the same, I imagine. The difference is that Google hasn’t built its reputation on privacy (far from it).
As you said, Apple has been banging on the privacy drum for years now. Then they turn around and say they’re going to be scanning your photos and then decrypting them if they’re flagged. That is a turnaround, no matter how they spun it. So while everyone is 100% behind stopping the spread of child pornography, folk also are right to wonder what the next intrusion will be.
This isn’t about what Apple has done now. It’s about what Apple will do next. Google doesn’t come into it because no one trusts Google anyway.
This probably also means eventually (if not already) Apple is scanning data that goes through iCloud Private Relay. Why try and force every ISP to scan people's data when they can by default pass it all through an Apple server? One hell of a lot easier to have a single point to collect data from.
Mmmm 🤔
The ISPs would surely be a better bet. This will only trap Apple users. What about Windows and Android users?
This probably also means eventually (if not already) Apple is scanning data that goes through iCloud Private Relay. Why try and force every ISP to scan people's data when they can by default pass it all through an Apple server? One hell of a lot easier to have a single point to collect data from.
Mmmm ߤ䦬t;br> The ISPs would surely be a better bet. This will only trap Apple users. What about Windows and Android users?
Well we don't know if Apple is performing a MITM attack on the data by claiming it's encrypted in Safari, but it's actually being encrypted on Apple's servers then sent to Safari over the iCloud VPN - after scanning of content. That's not possible for an ISP to do. So whilst it'd only work for Apple users, they'd have much better data on those Apple users.
Seems like nearly all commenter didn’t read the article, or even the headline, before commenting.
To be fair, most other media outlets offer way worse headlines, and not a one I’ve seen outside of AppleInsider has even attempted to calmly explain the policies.
As Mike W pointed out … Apple is actually the LAST tech behemoth to implement these policies. Where were you people when Google, Facebook, Microsoft, and Twitter among others adopted these same controls and rules?
What good are parental controls if they don’t do anything about child sexualisation and exploitation?
Those other companies don’t make privacy a main selling point.
Seems like nearly all commenter didn’t read the article, or even the headline, before commenting.
To be fair, most other media outlets offer way worse headlines, and not a one I’ve seen outside of AppleInsider has even attempted to calmly explain the policies.
As Mike W pointed out … Apple is actually the LAST tech behemoth to implement these policies. Where were you people when Google, Facebook, Microsoft, and Twitter among others adopted these same controls and rules?
What good are parental controls if they don’t do anything about child sexualisation and exploitation?
Those other companies don’t make privacy a main selling point.
How can this even stand up in court if their detection finds something? Wouldn't that be an illegal search and seizure or even a warrantless search?
And if the searches use hashes, couldn't someone that has this material just modify the images in some way as to change the hash? Add a watermark or reverse the image, etc?
Let's just put cameras in everyone's home that use technology to scan for illegal activity and that notify authorities if it finds something. I fail to see the difference.
How could a "colossal fuck-up" by Apple ruin a child's life? I think in almost every scenario, the "someone" would be an adult who has been falsely tagged.
This probably also means eventually (if not already) Apple is scanning data that goes through iCloud Private Relay. Why try and force every ISP to scan people's data when they can by default pass it all through an Apple server? One hell of a lot easier to have a single point to collect data from.
Mmmm ߤ䦬t;br> The ISPs would surely be a better bet. This will only trap Apple users. What about Windows and Android users?
Well we don't know if Apple is performing a MITM attack on the data by claiming it's encrypted in Safari, but it's actually being encrypted on Apple's servers then sent to Safari over the iCloud VPN - after scanning of content. That's not possible for an ISP to do. So whilst it'd only work for Apple users, they'd have much better data on those Apple users.
Right, so you make the request, that goes through your ISP which routes it through Apple servers. But they just have the request, not what was sent back. All they see is the encrypted stuff which Safari unpacks at your end?
Such things are always passed in the guise of things that make those who object them look like monsters: child abuse, terrorism, etc.
In reality, once the infrastructure is in place, Apple won’t be able to resist political pressures. China may force them to include pictures of Winnie the Pooh, because they are used to mock Xi Jinping in China, or pictures of pro democracy protests; some African regimes, where homosexuality is outlawed, might require the addition of a gay sex database, Russia may want to look for pictures or videos by Nawalny, etc. etc.
Once this train leaves the station, it can’t be stopped. Do NOT BE FOOLED by the benign cause that is behind the initial rollout! This will be worse than the deceptively named PATRIOT ACT.
Putting all the slippery slope, authoritarian government, false positives arguments aside I don’t see how this isn’t a PR nightmare for Apple right now. Apple has been banging the privacy drum for years now. (Remember that billboard in Vegas, what’s on your phone stays on your phone?) How do they explain this in terms non technical people will understand? I get what they’re doing here. I can see how it can be abused. But at the end of the day Apple just bought themselves a huge amount of bad press. Checking data on my device doesn’t jive with “we can’t see what’s on your phone”. Nor being able to tell that someone is sexting in iMessages. I see a Steve Jobs (like the antenna gate one) style video coming soon from Cook.
This probably also means eventually (if not already) Apple is scanning data that goes through iCloud Private Relay. Why try and force every ISP to scan people's data when they can by default pass it all through an Apple server? One hell of a lot easier to have a single point to collect data from.
Mmmm ߤ䦬t;br> The ISPs would surely be a better bet. This will only trap Apple users. What about Windows and Android users?
Well we don't know if Apple is performing a MITM attack on the data by claiming it's encrypted in Safari, but it's actually being encrypted on Apple's servers then sent to Safari over the iCloud VPN - after scanning of content. That's not possible for an ISP to do. So whilst it'd only work for Apple users, they'd have much better data on those Apple users.
Right, so you make the request, that goes through your ISP which routes it through Apple servers. But they just have the request, not what was sent back. All they see is the encrypted stuff which Safari unpacks at your end?
Normally yes. With iCloud Private Relay the ISP only sees packet header information (destination IP and source IP mainly), and from that can only discern the data is going to Apple. What request or data is inside that is unknown to your ISP. Only Safari can unpack the received data.
Apple however, could be using iCloud private relay as an encryption-stripping proxy: Through iCloud Private Relay, Safari asks the iCloud server to fetch a particular site, which then fetches the page on behalf of Safari. The connection between the requested site and iCloud server is encrypted, but the iCloud server can decrypt it as it was the one making the request. That request is then re-encrypted over the iCloud VPN, and displayed in Safari after being scanned, unbeknownst to the user.
The more I read about this, the more ridiculous it sounds. Apple spends the past three years banging on about privacy, then starts scanning your photo library? I don’t buy it, and no one would buy another iPhone if they thought their lives could be ruined by buggy software. The only way I see this being acceptable is if this so-called “client-side tool” would allow parents to ensure their children weren’t sending naked pics of themselves to Republican politicians posing as high-school kids.
Okay, so this is about the kids, fair enough, but I think what we’re seeing here is the very thin edge of very wide edge.
Thing edge to a very wide edge? How so?
Yeah, sorry, I meant “very wide wedge”.
But what is the very wide wedge? What do you suspect this change by Apple potentially leads to?
Well, the middle of the wedge is authoritarian governments telling Apple that they must now use this clever system of theirs to report on other types of images.
When the Chinese government tells Apple that they want to flag for hashes of images of a political opponent in every citizen’s photo library (oh, and they mustn’t tell anyone they’re doing it because that’s the law), do you think Apple will withdraw from the country immediately, or comply with the request?
You misunderstand my question. I don't doubt governments will try to expand surveillance on citizens (through leaning on tech companies whenever possible). That is the nature of power, the more power they get they more they'll use it to keep and expand power. You give them A they'll be coming for B. When you give up and allow B they'll be coming for C. It's a story repeated through 6000 years of humans jockeying for power. But when you say "wide wedge" it is a non descript phrase some won't take to heart. IMHO pointing out the specifics of what can happen helps people to see what are specific cases.
How can this even stand up in court if their detection finds something? Wouldn't that be an illegal search and seizure or even a warrantless search?
And if the searches use hashes, couldn't someone that has this material just modify the images in some way as to change the hash? Add a watermark or reverse the image, etc?
Let's just put cameras in everyone's home that use technology to scan for illegal activity and that notify authorities if it finds something. I fail to see the difference.
In the case of child abuse or sexual harassment, rules of law and evidence are not relevant.
All it takes is an accusation and a prosecutor on the band wagon or simply trying to make a name for himself.
It's the modern day version of the Salem Witch Trials.
Such things are always passed in the guise of things that make those who object them look like monsters: child abuse, terrorism, etc.
In reality, once the infrastructure is in place, Apple won’t be able to resist political pressures. China may force them to include pictures of Winnie the Pooh, because they are used to mock Xi Jinping in China, or pictures of pro democracy protests; some African regimes, where homosexuality is outlawed, might require the addition of a gay sex database, Russia may want to look for pictures or videos by Nawalny, etc. etc.
Once this train leaves the station, it can’t be stopped. Do NOT BE FOOLED by the benign cause that is behind the initial rollout! This will be worse than the deceptively named PATRIOT ACT.
As I mentioned earlier, not long ago homosexuals were regarded as far more evil that pedophiles. And pictures of homosexual acts were very much taboo... Before then it was interracial stuff that society condemned.
Society changes.
But yeh, then we get to issues of power and control.
Each society and each time period decide on their own taboos.
The more I read about this, the more ridiculous it sounds. Apple spends the past three years banging on about privacy, then starts scanning your photo library? I don’t buy it, and no one would buy another iPhone if they thought their lives could be ruined by buggy software. The only way I see this being acceptable is if this so-called “client-side tool” would allow parents to ensure their children weren’t sending naked pics of themselves to Republican politicians posing as high-school kids.
Okay, so this is about the kids, fair enough, but I think what we’re seeing here is the very thin edge of very wide edge.
Thing edge to a very wide edge? How so?
Yeah, sorry, I meant “very wide wedge”.
But what is the very wide wedge? What do you suspect this change by Apple potentially leads to?
Well, the middle of the wedge is authoritarian governments telling Apple that they must now use this clever system of theirs to report on other types of images.
When the Chinese government tells Apple that they want to flag for hashes of images of a political opponent in every citizen’s photo library (oh, and they mustn’t tell anyone they’re doing it because that’s the law), do you think Apple will withdraw from the country immediately, or comply with the request?
You misunderstand my question. I don't doubt governments will try to expand surveillance on citizens (through leaning on tech companies whenever possible). That is the nature of power, the more power they get they more they'll use it to keep and expand power. You give them A they'll be coming for B. When you give up and allow B they'll be coming for C. It's a story repeated through 6000 years of humans jockeying for power. But when you say "wide wedge" it is a non descript phrase some won't take to heart. IMHO pointing out the specifics of what can happen helps people to see what are specific cases.
You can blame it on authoritarianism or power. But we do it too. We've been doing it. We made it public and official with the Patriot Act. Our NSA knows whether you've been bad or good. So does the FBI. And, didn't Apple just turn over the private information of Democratic law makers to Republicans?
This probably also means eventually (if not already) Apple is scanning data that goes through iCloud Private Relay. Why try and force every ISP to scan people's data when they can by default pass it all through an Apple server? One hell of a lot easier to have a single point to collect data from.
Mmmm 🤔
The ISPs would surely be a better bet. This will only trap Apple users. What about Windows and Android users?
With end-to-end-encryption becoming the norm there's very little ISPs will be able to do. On-device monitoring is really the only workable option for automatic detection.
Comments
The only reason there's a significant uproar over this now is that Apple themselves created this whole "privacy is a core value" marketing plan they've been promoting for several years. They intentionally left the impression, whether entirely accurate or not, they had put up an impenetrable barrier that some Apple users now see them installing a doorframe in. The outcry is of Apple's own making IMHO.
The ISPs would surely be a better bet. This will only trap Apple users. What about Windows and Android users?
And if the searches use hashes, couldn't someone that has this material just modify the images in some way as to change the hash? Add a watermark or reverse the image, etc?
Let's just put cameras in everyone's home that use technology to scan for illegal activity and that notify authorities if it finds something. I fail to see the difference.
In reality, once the infrastructure is in place, Apple won’t be able to resist political pressures.
China may force them to include pictures of Winnie the Pooh, because they are used to mock Xi Jinping in China, or pictures of pro democracy protests; some African regimes, where homosexuality is outlawed, might require the addition of a gay sex database, Russia may want to look for pictures or videos by Nawalny, etc. etc.
Once this train leaves the station, it can’t be stopped. Do NOT BE FOOLED by the benign cause that is behind the initial rollout! This will be worse than the deceptively named PATRIOT ACT.
Apple however, could be using iCloud private relay as an encryption-stripping proxy: Through iCloud Private Relay, Safari asks the iCloud server to fetch a particular site, which then fetches the page on behalf of Safari. The connection between the requested site and iCloud server is encrypted, but the iCloud server can decrypt it as it was the one making the request. That request is then re-encrypted over the iCloud VPN, and displayed in Safari after being scanned, unbeknownst to the user.
But when you say "wide wedge" it is a non descript phrase some won't take to heart. IMHO pointing out the specifics of what can happen helps people to see what are specific cases.