Comment by whoknowswhat11 | Hacker News Reader

Comment by whoknowswhat11 | Hacker News Reader

Parent Full thread

No - the reporting is absolutely terrible here.

1) These are more share similar visual features than crypto hashes.

2) HN posters have been claiming that apple reviewing flagged photos is a felony -> because HN commentators are claiming flagged photos are somehow "known" CASM - this is also likely totally false. The images may not be CASM and the idea that a moderation queue results in felony charges is near ridiculous.

3) This illustrates why apple's approach here (manual review after 30 images or so flagged) is not unreasonable. The push to say that this review is unnecessary is totally misguided.

4) They use words like "hash collision" for something that is not a hash. In fact, different devices will calculate DIFFERENT hashes for the SAME image at times.

One request I have - before folks cite legal opinions - those opinions should have the name of a lawyer on them. Not this "I talked to a lawyer" because we have no idea if you described things accurately.

>> those opinions should have the name of a lawyer on them.

Not going to happen. Lawyers in the US have issues with offering unsolicited advice, and other problems with issuing advice into states where they are not admitted. So likely none of the US lawyers (and the great many more law students) here will ever put their real name to a comment.

This. Also try contacting a lawyer who knows this area and asking to pay for a legal opinion brief so that you can post it online to be debated by legions of software developers.

Lawyers I know would politely decline that.

No - this is actually done supposedly as part of biz dev.

So your own firm may cover some costs if you have something to say. If you found someone to pay for you to do an analysis or offer your thoughts - you'd be in heaven!

This is incorrectly applied. Offering a legal opinion is fundamentally different from offering legal advice. We publish legal opinions in academic and professional publications all the time. That doesn't mean we have an attorney-client relationship with anyone who reads those opinions, or that we would advise that someone act in accordance with such an opinion, particularly if no court has adopted our position yet.

but there are legal opinions that law firms and various orgs(political or not) that wite on occasion from actual lawyers sharing a legal opinion, publicly(or not).

But it's the law, it's fuzzy at best, much like your HR department. It's only after a court decision has been reached on your particular issue that it's anywhere near "settled" case law, and even that's up for possible change tomorrow.

Right. That's why there's never been an amicus brief or a friends of the court type of document drafted and signed by lawyers.

Those are addressed to a court or government agency in a specific place. The advice offered isn't for a bunch of rando people on the internet across all number of jurisdictions. And it is only general advice about an area of law, normally at the appellate level, not specific fact-dependent advice to a real flesh-and-blood person. Amicus is also normally an opinion to sway the court on broad policy, not a determination of facts in a specific case.

Sure - but if you are going to write blog posts / articles - and all you can say is based on the lawyers I talked to apple is committing child porn felonies, that is just unacceptable.

At least HN should flag these and get these taken down. Over and over the legal analysis is either trash or it's clear the article author didn't understand something (so how can lawyer give good advice?).

These conversations become so uninteresting when people take these extreme type positions. Apple's brand is destroyed - apple is committing child porn felonies.

I would have rather just had a link to the apple technical paper and a discussion personally vs the over the top random article feed with all sorts of misunderstandings.

And in contract law there are LOTS of legal articles online - with folks name on them! They are useful! I read them and enjoy them. Can we ask for that here where it matters maybe more?

>> there are LOTS of legal articles online - with folks name on them

Articles are not legal advice. They are opinions on the law applicable generally, rather than fact-based advice to specific clients. Saying whether apple is doing something illegal or not in this case, with a lawyer's name stamped on that opinion, is very different.

> The images may not be CASM and the idea that a moderation queue results in felony charges is near ridiculous.

Agree, and I think this is backed up by real world experience. Has Facebook or anyone working on their behalf ever been charged for possession of CSAM? I guarantee they've seen some. Probably a lot, in fact. That's why we have recurring discussions about the workers and the compensation they get (or not) for the really horrid work they are tasked with.

From what I understand it's even more cut and dry than that. If you submit a report to the NCMEC you are generally required to (securely) keep a copy of the image(s) being reported and any related info for a period of time. That's part of the rules. You are also only compelled to report things that you know are bad, so verification before reporting makes sense. The idea that they would be charged with a crime for doing what is essentially required by law is flat out wrong. Unless they are storing the material insecurely once confirmed bad or otherwise mishandling the process, they seem to be following the law as I understand it. IANAL but I have an account with the NCMEC for a service I run, so I have looked through their documentation and relevant laws to try to understand the requirements placed on me as a service provider.

Thank you for a first hand report. All that makes sense - you clearly can't and shouldn't "pass around images" even in the office - so fair that it is super strict once something is confirmed as X.

More of an anecdote, but our software allows users to upload files, documents, images and such. This in turn means, technically speaking, our platform could be used to distribute malware or other illegal content. I've asked: Well what happens if that occurs and we as a company becomes aware?

Overall, we're advised to take about these steps there. First off, report it. Second, remove all access for the customer, terminate the accounts, lock them out asap. Third, prevent access to the content without touching it. For example, if it sits on a file system and a web server could serve it, blacklist URLs on a loadbalancer. Fourth, if necessary, begin archiving and securing evidence. But if possible in any way, disable content deletion mechanisms and wait for legal advice, or the law enforcement to tell you how to gather the data.

But overall, you're not immediately guilty for someone abusing your service, and no one is instantly guilty for detecting someone is abusing your service.

> Probably a lot, in fact.

> In 2020, FotoForensics received 931,466 pictures and submitted 523 reports to NCMEC; that's 0.056%. During the same year, Facebook submitted 20,307,216 reports to NCMEC

https://www.hackerfactor.com/blog/index.php?/archives/929-On....

The problem isn't the idea of CASM, it's that what happens when they start scanning for "misinformation", or whatever else they want to come up with at that point.

Then why not wait until that actual issue comes up. The look is so bad / awkward with this big protest over something that many people are not going to find at all objectionable.

Do you really think Apple's brand has been "destroyed" over this?

IMO the risk is that the reaction will be viewed amongst the general population as an overreaction, leading to it being ignored on the next go around. Many people are going to listen to what Apple says, look at their piles of technical documentation, see the word CSAM, and conclude that the opposing side is crazy.

Or how about they just don't scan my phone at all.

feel free to go ahead and opt out.

Reply on news.ycombinator.com