Comment by Someone1234 | Hacker News Reader

Comment by Someone1234 | Hacker News Reader

If it matches, am I guilty until found innocent?

I have no illicit images, but false positives are always going to be a problem and even at sub-1% rates if you're scanning literally every image stored on an iOS devices that could still be thousands of wrong matches. If I lose the false-positive lottery, am I going to have the police calling and have my mugshot in the evening news for "CP on their device" in particular in my state's months long backlog for digital forensics. Law enforcement aren't exactly known for their understanding of technical evidence like hash-matching.

I'm very sympathetic/supportive of anti-CP initiatives in general, but this still seems problematic.

PS - And before someone replies with "they aren't contacting the police," don't forget the "yet." Once this is in place they'll immediately get pressured by politicians and well-intentioned people alike to flag any positive detections to authorities who will overreact (as law enforcement has a history of doing, particularly around this topic).

"I have no illicit images, but false positives are always going to be a problem"

Or someone that doesn't like you can MMS/iMessage/e-mail you images that match PhotoDNA image hashes. Maybe even in a way where the images don't appear to be anything alarming.

Yep, Google can break SHA1, so what hash are they using? Proprietary information I assume.

They aren't using file hashes like SHA1, but perceptual hashes and then a fuzzy metric like hamming distance to make a fuzzy match. It's entirely possible for two images that have nothing to do with each other to have similar hashes.

Wow. That's much worse.

Yes, that's what I was alluding to. It's a perceptual hash, so you could probably take a flagged image and superficially alter it (contrast/color/crop/whatever) until it wasn't anything visually objectionable on it's own. But it would still match the perceptual hash.

The poor souls that do the work of entering the images into the database select identification blocks, not showing the victim (a lamp, wall paper, etc), that reviewers on the “client” side check against

In the United States, the process of reporting potential images of CSAM is defined by the government, and a technology company’s active responsibility ends with a report to the National Center for Missing and Exploited Children’s CyberTipline: https://www.missingkids.org/gethelpnow/cybertipline#whathapp...

From the article:

> The automated system would proactively alert a team of human reviewers if it believes illegal imagery is detected, who would then contact law enforcement if the material can be verified. The scheme will initially roll out only in the US.

This is dystopian and needs to be opposed, not applauded.

This is how every single cloud service has worked for a decade. You’ll need to elaborate on how, exactly, you believe it’s dystopian. The article is clearly wrong, because Apple cannot know which jurisdiction to forward a report to. That is NCMEC’s responsibility.

This is on your device, not hosted by a third party (and therefore not a third party liability). Kind of like if your microwave was checking that there wasn't any illegal activity happening in your home and phoning home if it has a suspicion.

As others mentioned, privacy erosion only goes one way. This is a frontier being breached, i.e. searching your physical device without a warrant, and as usual in the name of CP (the alternative typical pretext being terrorism). It won't take very long before this gets extended to any illegal activity. Gay dating was an illegal activity until not so long ago. This sort of chinese-style monitoring is not desirable in any way, and I find it appalling that Apple seems to want to be the sponsor.

No it’s not. Read the article: the proposed mechanism is implemented as part of photo upload to iCloud.

The title says "scan US phones", the article is behind a paywall.

https://archive.is/https://www.ft.com/content/14440f81-d405-...

Thanks. The article confirms the title, this is not about content uploaded to the cloud:

Apple’s system is less invasive in that the screening is done on the phone, and “only if there is a match is notification sent back to those searching”, said Alan Woodward, a computer security professor at the University of Surrey. “This decentralised approach is about the best approach you could adopt if you do go down this route.”

https://twitter.com/matthew_d_green/status/14231090022805135... and https://twitter.com/matthew_d_green/status/14231094582936289... kind of sums it up. Clearly there is an intent to progress to more than just what's been shared with iCloud. Otherwise there'd be no need for software on the devices themselves at all.

That is not the only explanation. Involving the device could be considered better because it doesn’t require Apple to build infrastructure to scan all your photos in the cloud, which could be more easily repurposed without user consent.

They scan photos in the cloud now. And do you think Apple will announce and let users opt out of client side scanning changes?

As far as is publicly known, only iCloud Mail was being scanned before this announcement. This is consistent with the lack of overall CyberTip reports from Apple historically (orders of magnitudes lower than comparable platforms).

Articles said Apple scanned iCloud photos last year. I see some of them were updated to be less specific.

The slant I took from that thread is this is the way to comply with known-bad-hash matching requirement while preserving E2E encryption for cloud-stored content: checking hash at an end.

Don’t need to MITM when you put an M at an end.

iCloud photos aren't E2E encrypted now. This could be a way to add E2E encryption while preserving the current level of surveillance. Except the article said Apple can decrypt suspect photos. And it isn't a legal requirement apparently.[1]

[1] https://news.ycombinator.com/item?id=28077619

> According to people briefed on the plans, every photo uploaded to iCloud in the US will be given a “safety voucher” saying whether it is suspect or not. Once a certain number of photos are marked as suspect, Apple will enable all the suspect photos to be decrypted and, if apparently illegal, passed on to the relevant authorities.

AWS doesn't do any automatic fingerprinting of files being uploaded to S3 and never has. The only time I've heard of anything like this was briefly when Microsoft was doing it, and I don't know if that was shutdown long ago due to outrage or not.

AWS doesn’t have to because the entity which writes those files is obligated to do this scanning if there is reason to believe the files contain CSAM.

I guess I should clear up: Amazon isn't doing any type of automatic file-scanning for anything being uploaded to S3, or feeding md5/sha1/sha256sums to some 3rd party service automatically for everything that touches S3.

If they get a subpoena and then maybe send some kind of file list/checksums they've been required to hand over to some 3rd party / government? That's possible, but an entirely different situation.

Sure, but whoever owns the account which wrote those files in is, in the United States, responsible for doing some version of what Apple has announced they will do with iCloud Photos today.

It's dystopian because a private company, who in the past has been committed to maintaining user privacy even when it inconveniences the government, is now regressing and going to scan the "private" contents of peoples' phones to see if they have any matches for images that have been added to a government-supplied blacklist. This blacklist is completely opaque to us as citizens; there is no way to audit or review the contents. Additionally because it's using photoDNA, if someone ever did get ahold of even a single entry in the database, they could craft malicious images that fool the perceptual hash algorithm into flagging an innocent image. (Yes, I get there will be manual review, etc).

Furthermore in principle there's no reason this has to be, or will be, just CP. First it'll expand to blatant terroristic images, say ISIS beheading type videos. Then it will progress to subversive material: COVID "misinformation", "domestic terrorism" (read: anyone the feds don't like), the list goes on. This tool and its successors will be used to completely abolish the concept of device privacy and will be used to ruin the lives of anyone who sufficiently pisses off the feds. And that's just in America, god knows what they're going to do with this system in China.

1. Apple has only stated a commitment to protecting user privacy to the extent it is legal. They make a lot of suspicious operational changes to how they operate in China, for example. Their opposition to the FBI case was because they believed the request placed on them was illegal.

2. This article only provides evidence to say Apple will scan photos you upload into iCloud. Scanning local photos is your speculation.

3. The operation of NCMEC and the blacklist is defined by the Federal government. American (citizens) have some mechanism to oppose this design. Apple could perhaps lobby against it, but their lobbying operations are famously minimal.

4. In principle, Apple could do anything. That doesn’t really inform what they’re likely to do. Just like in principle, anyone could slip a malicious content scanning patch into the Linux kernel (and this already has a POC!).

> will initially roll out only in the US.

Ok so they’re planning to eventually roll out this spyware worldwide. I do not know how Americans can think China is bad in this while allowing this to happen.

Never ceases to amaze how people believe that China is somehow more oppressive than the the country with world highest incarceration rate.

You forget that death sentences are carried out much more swiftly in China.

Also, while there's a lot to be said about court systems, public defenders etc in US I wouldn't compare the two.

China have actual slaves. You can't even know the real rate of incarceration in China, and trying to figure it out is almost a sure way to get arrested.

The US has a high incarceration rate because it has a high crime rate. If EU countries had US levels of crime, they'd have US levels of incarceration.

Also China doesn't count Uyghurs as incarcerated despite the fact that the PRC is committing genocide against them.[1] The PRC imprisons almost 2 million of Uyghurs a year. Of those, around a quarter million die. Oh and there's the forced sterilizations, destruction of mosques, brainwashing, banning of muslim-sounding names[2], forced labor, organ harvesting, and mandatory quartering of government agents.[3]

1. https://en.wikipedia.org/wiki/Uyghur_genocide

2. https://en.wikipedia.org/wiki/Naming_laws_in_China

3. https://en.wikipedia.org/wiki/Civil_Servant-Family_Pair_Up

US has a high crime rate, because it has laws introduced specifically to increase the crime rate in specific racial groups; that’s where the War on Drugs came from.

China doesn’t count Uyghur extremists as incarcerated for the same reason the US doesn’t count their brethren it kills en masse in Middle East as death sentences. It’s just a different thing.

As for the rest of the list - most of it is just US state propaganda calling resocialization programs “brainwashing”, or leveling commercial buildings built without building permit “destruction of churches”. Some of that works exactly the same in US (forced labor), or is just entirely made up (“quarter million die”).

Now, some of the stuff is a real problem of course - death sentences and organ harvesting - but throwing it together with the usual US propaganda doesn’t help the cause.

> US has a high crime rate, because it has laws introduced specifically to increase the crime rate in specific racial groups; that’s where the War on Drugs came from.

That's not true. If you released everyone convicted of a drug crime (including manufacturing, selling, or distributing), you'd decrease the US prison population by 20%.[1] I'm all in favor of ending the drug war, but that won't do much to the incarceration rate. Also, the drugs that are illegal in the US are just as illegal in other developed countries (if not moreso). To use one example: in the UK, you can get up to 7 years in prison for simply possessing LSD or shrooms, and life in prison for for supplying or producing them.[2] No european country has legalized recreational marijuana[3], while the state I live in legalized it a decade ago. Now look at China's drug laws. While in China I've been solicited for all kinds of illegal goods and services, but never drugs. Stolen or fake merchandise? Sure. Prostitution? Of course. But drugs? Not a chance. The reason for this is that China executes people for drug possession. They randomly test foreigners entering the country and prosecute them even if they have no drugs on them.[4] The government raids nightclubs and residences, then forces everyone to take drug tests and prosecutes them if they test positive.

But please go on about how oppressive the US is.

I've seen you comment on China several times before and it's always in favor of the PRC. This confuses the hell out of me. Consider this: We could not have this discussion in China. To contradict the official narrative there is to risk your career and your freedom. Yes, the US and other countries have big problems, and it's good to try and fix them. But the level of surveillance and oppression in China is unlike anything in the west.

1. https://www.prisonpolicy.org/reports/pie2020.html#firstmyth

2. https://www.gov.uk/penalties-drug-possession-dealing

3. https://commons.wikimedia.org/wiki/File:Map-of-world-cannabi...

4. https://www.gov.uk/foreign-travel-advice/china/local-laws-an...

Sentencing for drug possession has secondary effects - it pushes large number of people into other kinds of crime. Thus, you cannot count only the direct 20%.

Regarding other countries - what would happen (and happened) to countries that refused to join War on Drugs?

Regarding possession - in UK essentially nobody cares, unless you’re distributing industrial quantities and/or are really obnoxious about it, eg walk into Constabulary smoking a joint, or by putting up advertisements. There are regular news about eg police finding a suspect car parked for six hours with engine on, filled with smoke (actual example I remembered because it’s funny) and they don’t result in charges. I suppose the law could be used if you also committed other offenses.

As for not being able to talk politics in China: where all the policy and law changes come from then? And if you can freely talk in the US, why so many people have many throwaway accounts here on HN?

Anyway: yes, China is oppressive in a number of ways. It’s about one generation behind the US, except for racism, where it’s ahead. US itself is perhaps a generation behind Western Europe. But everyone knows what’s bad about China, and everyone knows what’s good in the US. Anti-Chinese propaganda is everywhere, and I find it quite annoying. Particularly so because it detracts attention from real problems - if American propaganda is lying about genocides and missile silos, why assume other parts are true? Secondary: all the bad stuff in China stays in China. They don’t routinely exterminate hundreds of thousands people in other countries for financial or racial reasons. They don’t intentionally ruin other nations’ economy. The US does. And I feel like this perspective is entirely lost among western population.

Reply on news.ycombinator.com