https://www.businessinsider.com/police-say-a-google-tip-abou...
https://cbs4indy.com/news/indycrime/muncie-man-arrested-on-c...
https://www.nytimes.com/2022/08/21/technology/google-surveil...
https://www.businessinsider.com/police-say-a-google-tip-abou...
https://cbs4indy.com/news/indycrime/muncie-man-arrested-on-c...
https://www.nytimes.com/2022/08/21/technology/google-surveil...
Microsoft publicly released PhotoDNA only in 2009, and even at that time its use was very limited. A few cloud services adopted it for cloud-uploaded files, which (back then) tended to have a clear UX distinction from private content (in the sense that users either knew they were making a public post, or at least had to make an affirmative decision to upload each piece of content.) Even during this time, some providers only enforced CSAM detection on content explicitly shared with others, while some were more vague about their policies. Still others refused to scan much at all. As an HN reader you may have known this scanning was in place, but in reality it was sporadic and very few platforms made public efforts to engage with customers and explain whether or what they were actually scanning. (For a contrasting example, see Apple's very public messaging efforts around CSAM scanning from 2021.)
Today's big private messaging platforms like Facebook Messenger, WhatsApp, WeChat and iMessage didn't really come on the scene until around 2011. Excepting Chinese platforms, most of these messaging platforms do not employ content scanning for private messages. Perhaps the major exception to this rule is Facebook Messenger, which made the (IMHO thoughtless) decision to add CSAM content scanning across its entire network, and didn't bother to make a distinction between "public" and private messaging. But even Facebook has clearly reconsidered this hasty decision, given that they're planning to deploy default E2E encryption for Messenger (as they already do for WhatsApp), and have publicly opposed adding content scanning to that system. Meanwhile transparent smartphone backup systems like iCloud Photos are even newer, and have not always scanned private backup data. (See again Apple's public attempt in 2021 to deploy this scanning, which failed due to customer pushback.)
TL;DR: content scanning is a relatively new technology that only had relatively limited deployments, sometimes only on public data or data explicitly uploaded. It was deployed relatively quietly so that "society" never really had the opportunity to have a public debate about whether or where it should be deployed. For better or worse, we are now having that debate. I think it is very unhelpful to imply that this is some long-deployed technology that all providers have always used on private data, because that's (1) not really accurate, and (2) short-circuits the debate and implies that we've already made an important decision.
Like I don't like this plan but I also have to be realistic that my reaction as someone who values privacy is way overblown.
The way we engage with data is also very different. Back in 2008 I kept most of my photos and private papers in hard-copy form inside my house, or (perhaps) on a local hard drive. Today nearly all of my private papers and photos live in my phone, and for most people a duplicate copy lives on an Apple or Google server somewhere. Having your phone's data stolen is literally a life-altering event for many people, one that is mostly avoided through local data encryption. This is leaving aside the societal implications of ubiquitous scanning, which would effectively undo two centuries of limited policing.
This was also a time before massive data breaches and ransomware and revenge porn and data extortion were routine. The big high-profile leaks of celebrity nudes wouldn't happen until 2014. Indeed, the very notion of having cloud-backed smartphone photos stolen was hardly a thing, because cloud backup mostly didn't exist and routine use of phones to take private, explicit imagery was not a thing most people engaged in. In our time, sextortion has become so routine that it's a major category of child abuse. To deal with this changed landscape, security has been massively upgraded across cloud and messaging services. Part of that upgrade is the default use of user-controlled encryption for local data as well as the default use of E2E encryption for most messaging.
You can't say "everything was fine" because by and large most things were not fine. From a security perspective things were actually fairly bad! We've made a lot of progress since the time when photo scanning was first launched, including the launching of widespread encryption as a means to prevent breaches. Client-side scanning implies at least weakening some of those measures, and possibly eliminating others.
Governments have no right to compel companies to engage in policing activities like this.
It's called privatization of tyranny and it's been going on forever.
Companies like to do it to get closer to the government to get less regulation or government contracts.