An open letter against Apple's new privacy-invasive client-side content scanning

https://github.com/nadimkobeissi/appleprivacyletter

by yewenjie • 5 years ago

1082 404 5 years ago

riffraff• 5 years ago

I signed this, but I'm very doubtful this will ever achieve something.

But this made me wonder: is there an history of people complaining about this sort of things and actually achieving something?

I think this might have happened with MSFT's hailstorm/passport, where in the end industry opposition meant the project was abandoned, but I can't recall other instances.

almostdigital2• 5 years ago

Last year Apple reacted after the outcry about MacOS tracking[1] so there is some hope. That was not a deliberate product and probably more of an unintended behavior though.

I'm really hoping this was just a team at Apple that got blinded by all the cool cryptography they came up with to solve a problem and that the higher ups will react if we screech loudly enough.

[1] https://sneak.berlin/20201112/your-computer-isnt-yours/

okamiueru• 5 years ago

Last year Apple reacted

How did they react? Isn't it still in effect? Still sending unencrypted messages when apps are opened?

As far as I'm aware, they plan on having OCSP encrypted, and plan on giving users a choice.

I honestly do not get the outrage over the apple's client side scanning. It's outrageous, sure, but... much of the same people seem to have been ok with unencrypted telemetry being transmitted for every executable run. Not to mention that every executable will also be logged at some point, so apple knows every program you've ever run.

Torwald2• 5 years ago

is there an history of people complaining about this sort of things and actually achieving something?

The WASP did it to bring the browser vendors to comply to web standards, Netscape ans MS back then. In the EU you could make the case that user group lobbying influenced regulation.

userbinator• 5 years ago

is there an history of people complaining about this sort of things and actually achieving something?

One of the few tiny (and now seemingly completely void) victories I remember was the PIII processor serial number (1999): https://news.ycombinator.com/item?id=10106870

neolog2• 5 years ago

Google cancelled its DoD drone program because of employee protests. https://www.fedscoop.com/google-project-maven-canary-coal-mi...

seanp2k28• 5 years ago

I’m sure they just got Lockheed/Boeing/General Dynamics/Northrop/Raytheon/IBM to take it on for 10x the price.

kayxspre• 5 years ago

Not in a sense of "signed letter", but more like a "huge feedback". Six years ago MSFT planned to reduce free storage for existing OneDrive users to 5GB (after bumping it to 15GB + 15GB of Camera Roll bonus) [1]. Like other users, I was unhappy as I have been using OneDrive with the promise of bigger storage than Google.

Sure enough, over 72k votes at OneDrive's UserVoice [2] cause MSFT to back down. They still reduce the storage to 5GB, but existing users (myself included) can opt out of it.

[1] https://www.theverge.com/2015/12/11/9890966/microsoft-onedri...

[2] https://onedrive.uservoice.com/forums/262982-onedrive/sugges...

punnerud2• 5 years ago

Because it’s based on machine learning, why can’t some of the network and weights used for the hash be shared? So we can be sure it is not possible to match anything else than children.

The sub narrow network used for detecting only CP is of course secret, but then we know it can’t be used for revealing pictures of police, activists etc

Dylan16807• 5 years ago

It doesn't seem to work that way. It's a bunch of arbitrary hashes that might not show up as any content in particular except "this hash matches". In particular, there was someone claiming that images of empty rooms where abuse happened are part of the database, along with other images that appear in the same sets as CSAM.

doubtfuluser2• 5 years ago

Like stated below, I’m seriously worried about Adversarial examples that fool the network into A) hiding bad pictures being not recognized B) triggering false positives on harmless pictures to discredit people.

Opening up the network would mate it even easier to create the adversarials… Im not sure there is a winning position in the approach they used

punnerud2• 5 years ago

«even easier to create the adversarials», agree. But if they find one of this pictures they can retrain in a way that find all of them on all phones. So it will never be safe to have CP on the phone/iCloud.

And easier to keep Apple accountable on not matching anything else than the purpose.

matwood8• 5 years ago

Do you use iCloud photos now? CSAM checking has already been used for years (on almost all photos services btw).

pjerem• 5 years ago

Because the technology is not the point. I just don’t want Apple to search anything in my photos. Because those are my photos. Not theirs. My phone doesn’t need a program that search for abused child photography since there is not such material on it.

I don’t care if their thing is open or closed source : My iPhone is mine and I don’t want them to do anything on it that can get me arrested because of a false positive.

We must not accept those intrusions.

This thing is as serious as if IKEA regularly sent robots in your house to check all the photo albums on your IKEA shelf to check them against some database. Why does it sounds dumb when it’s IKEA but more acceptable when it’s your phone constructor ?

mbilal• 5 years ago

How to complain: don't buy an iphone next time you need a new phone

14• 5 years ago

I am going to give them a chance to reverse this but I literally just bought an upgrade to my iCloud. I thought it would make my life easier not having to worry about storage so much. Now I am just waiting for this reversal to happen or think I will have to cancel my iCloud subscription to start.

foxpurple2• 5 years ago

What cloud service are you putting your images on? I would be shocked if google photos hasn’t already been doing this.

sschueller• 5 years ago

Cloud services doing this isn't the problem and they are already doing it. The problem is your device doing this.

Imagine if your Tesla reported back to Tesla who was in your car and sent that to the authorities if they thought someone in your car was "illegal".

feanaro11• 5 years ago

Why do you need to put your images on a cloud service at all? Just use a spare disk.

pmlnr3• 5 years ago

You don't need the cloud: syncthing can sync your phone and your computer together without any issues. No nasty cloud provider involved: https://syncthing.net/

summm• 5 years ago

Cloud is other people's computers. So, get your own server, or use someone's you trust. or use e2e encryption.

UweSchmidt• 5 years ago

Boycotting products to change a company's mind won't work because:

- not enough people even know about this issue, understand the consequences or remember to act on it the next time a new phone is due - not enough alternatives on the market, and we're probably already boycotting them for other reasons - even with lower sales a company might not see the cause-and-effect

There is a general trend in the industry to take all kinds of liberties with user data. There is pressure on companies to do something about bad things happening in their clouds. Machine learning folks want to apply their tools to big data and the corpus of everyone's photos is probably nice to work with.

So we would have to tackle these issues on a larger scale.

nicce9• 5 years ago

That it is. I'm bit fancied of the ignorance of the people, until it is Apple who is doing it. And Apple is minority compared to other platforms.

I haven't heard much of complains about Windows sending all your file hashes and most of the files into their servers, what they have been doing a very long time with Windows Defender. It is literally the same what Apple is doing now, but without restrictions.

Google and other cloud service providers have scanned your photos for very long time, by using PhotoDNA. On top of images, Google scans also your emails. People forget and move on.

mongol• 5 years ago

Hmm. I wonder if a activism-based shopping platform could be something. Basically, a place where you shop, and as part of your purchase you state why you shopped that thing. Can be anything. "I liked the color". "Needed a bigger screen". "Don't want to use Apple any more".

indymike2• 5 years ago

Boycotting products to change a company's mind won't work because:

In this case not buying the product is to avoid a viperous feature and protect house of from being spied on. Any boycott effects are tertiary.

oakpond• 5 years ago

There is hardly any mention of a boycott. Cynicism prevails; Apple is laughing all the way to the bank.

vladharbuz• 5 years ago

Yesterday's discussion: https://news.ycombinator.com/item?id=28085632

rjzzleep5• 5 years ago

I was actually looking to buy the new iPhone should they add back TouchID, but this has been quite the turnoff.

Are Pixel phones the only android phones that allow you to do secure boot with non stock images and basically long term cripple phone functionality once its unlocked?

thg2• 5 years ago

Fairphone allows re-locking the bootloader with the /e/ rom flashed.

sleavey• 5 years ago

The annoying thing about unlocking or relocking the bootloader is that it wipes your phone. Unless you're paranoid that someone can give you a rootkit while you're not looking, as long as you use full device encryption then leaving the bootloader unlocked isn't too bad. Plus, it lets you upgrade your bootloader and OS later. I stupidly relocked the bootloader after installing LineageOS and now I can't upgrade the OS major version without wiping everything.

nicce9• 5 years ago

Google does the same with Google Drive. Apple is just late for the party.

nelox• 5 years ago

and Microsoft since 2009:

https://www.microsoft.com/en-us/photodna

Which, in turn, is used by FaceBook, Twitter, etc.

thesimon• 5 years ago

Apple does the same with iCloud as Google does with Google Drive.

Apple just now moved it to scan on the device.

whimsicalism• 5 years ago

Disingenuous false equivalence for anyone who knows the difference between server side and client side

cft2• 5 years ago

I was about to buy M1 Macbook. No thanks.

sneak• 5 years ago

From the letter:

Apple Inc. issue a statement reaffirming their commitment to end-to-end encryption and to user privacy.

Apple has no commitment to end to end encryption or user privacy; the premise of this letter is incorrect.

https://www.reuters.com/article/us-apple-fbi-icloud-exclusiv...

The data in iCloud is for the most part effectively unencrypted. iCloud Backup serves as a backdoor to e2e messaging, and iCloud Photos aren't e2e at all. If you are using iCloud Photos or iCloud Backup today (on by default and enabled on most iPhones), you are already uploading all of your data to Apple presently in a way that both Apple and the USG can read without a warrant.

This is by design.

tannhaeuser• 5 years ago

Is it ok nowadays to use github for pamphlets, "open letters" (that aren't letters), and other social media and polemic content to protest against privacy invasion of all things?

Torwald2• 5 years ago

Why should it not?

alichapman• 5 years ago

I'm not usually the most idealistic when it comes to FOSS, but it's stories like this and Apple's stance of "trust us, we promise we know what we're doing and that nothing is going to go wrong" that makes me think all software should be legally required to be open source.

dcow5• 5 years ago

It would be if y’all slapped the AGPLv3 on your code instead of Apache/MIT/BSD.

If we were to perform a cyber analog of what the founding fathers did for the USA 250 years ago, it would be something along the lines of declaring all software free from the tyranny of corporate control and state oppression. Free in perpetuity so that our digital projections onto hardware shall reside comfortably each in their own pursuit of happiness.

cinquemb2• 5 years ago

If we were to perform a cyber analog of what the founding fathers did for the USA 250 years ago, it would be something along the lines of declaring all software free from the tyranny of corporate control and state oppression.

… and then proceed to conduct asymmetric warfare against state and corporate cyber systems alike.

bnt3• 5 years ago

How would OSS help in this case? Someone can run a hash, find an “offensive” photo and jail you. Shit, if someone is out to get you, they will dig up any photo on your phone, put it in the “bad hashes” database and just wait for Apple to catch you. And then you’re effed, because no court will want to publicly display a photo that may contain child pornography, so you’ll be jailed without a fair trial.

OSS won’t help here. This system must be shut down, and the gov should deal with pedos in a different way.

dcow5• 5 years ago

They said FOSS, not OSS. F means free as in freedom. As in you’re free to modify the software running on your phone at will and to your liking and Apple or some government can’t get in your way.. not even for the kids.

thinkloop• 5 years ago

Google Photos and Gmail openly and heavily scan server-side, and I'm sure a lot of us use them, how do we reconcile that?

f6v• 5 years ago

The Big Tech is already here, it’s hungry for control and data. Not just for its own good, but to also serve the governments around the world. It’s going to happen eventually, and most people won’t care.

jpxw5• 5 years ago

I don’t use Android, so genuine question here: does an Android phone automatically upload everything to iCloud like an iPhone does?

With the iOS ecosystem, in my experience having everything backed up to iCloud is the default position, and you have to turn it off manually.

amelius2• 5 years ago

Google is heavily incentivized not to share the data with anyone else.

alerighi• 5 years ago

On the server side. That is the difference. I know that if I put something on Google Drive it is in clear in the Google servers.

What I don't want is Google performing a scan of the internal memory of my Android device!

Server side they can do whatever they want, and I choose what data they can access, but on my device not.

marcellus234• 5 years ago

You know it’s still only photos being uploaded to iCloud that are scanned right? Or are you just totally unfamiliar with the actual issue? If you are familiar, can you explain the practical difference between these approaches that makes one worse?

Nginx4874• 5 years ago

If you don't like it, you can use Protonmail instead of Gmail, and Mega instead of Google Drive, and still being able use Android device. But I totally understand frustration of users, whose smartphone suddenly turned into spyware.

bArray3• 5 years ago

Honestly I'm glad to see a non-insignificant amount of people in tech take this seriously, especially when the goal Apple announces appears to be for the greater good. It can be hard to stand on the side that doesn't immediately appear to be correct. We have already lost so many freedoms for 'national security' and other such blanket terminology.

Just be warned, there will be those that unfairly try to cast this as helping the distribution of CP. Expect a headline tomorrow: "Edward Snowden et al Supports Child Porn" - or some other hot take.

A few other things:

1. Vote with your feet - Put your money in the pockets of the people aligned to your values.

2. Actively support projects you align with - If you use some open source hardware/software, try to help out (financially or time).

3. Make others aware - Reach out to those around you and inform them, only then they can make an informed choice themselves.

peakaboo• 5 years ago

I think people need to wise up extreamly quickly to what we are facing here. I cannot overstate the importance of being extreamly sceptical of the motives of tech giants at this point in time.

Andrew_nenakhov• 5 years ago

especially when the goal Apple announces appears to be for the greater good.

Not surprising at all.

In Russia, _every_ measure to limit internet freedom was introduced under the pretence of fighting child pornography and extremism.

Then, of course, it was used to block the websites of political opponents.

hulitu2• 5 years ago

Not only in Russia. It's sad to see a country (in central europe) which puts a guy 8 years in jail for raping children more than 8 years, justifying such invazive software as defence against CP.

Muromec• 5 years ago

It was promotion of suicide before it was extremism and cp

rjzzleep5• 5 years ago

No need to look at russia only, what about Germany, one of those "bastions of free speech".

Also, wasn't the rational for the crypto ban the same? Either terrorism or Child Porn? If you support E2E you're effectively supporting child porn?

https://gigaom.com/2009/06/16/germany-to-vote-on-block-list-...

sillysaurusx2• 5 years ago

a non-insignificant amount of people in tech take this seriously

We're all here to make ourselves feel good saying we Took A Stand.

In reality, four weeks from now, do you think anybody will still be talking about it?

I made this same mistake. I was pretty convinced that people were taking Copilot seriously, and that there was possibly going to be ramifications for Microsoft. I wasn't particularly looking forward to it, but I rated it as plausible.

One stonewall and a few weeks later, here we are. Hardly a word anymore about it.

I think if there's going to be any real, long-term change, we have to find a way to combat the real threat: life goes on.

(Made me smile to phrase it like that, actually. That wasn't the combat I had in mind...)

It's true, though. Ask anyone in a month whether they take this seriously. They'll say yes. And what's it worth?

It's all we can do, of course. But that's just another way of saying we're powerless.

Like it or not, we aren't in control. And unless we can figure a way to get some measure of control, then what are we doing here, really?

Your three bullet points are wonderful, and I agree entirely with them. And it won't change a damn thing.

I'm not sure what to do about it.

dijit• 5 years ago

Can’t speak for everybody of course, but I am currently planning the migration away from the Apple ecosystem and I’m heavily invested (watch, phone, MacBook, Mac Pro, Apple TV).

I’ve also been recommending to friends and family to move to droids with microG.

The largest concern I have for them is that they’re stuck between the devil and the deep blue sea.

Most people aren’t going to run a droid without google, or Linux on the desktop.

roenxi• 5 years ago

Like it or not, we aren't in control.

The typical Apple customer is forking over thousands of dollars. They have substantial control. This isn't like a government where you need a plurality of voters to agree before anything starts to happen.

Apple is running software on their phone that will either (a) do nothing or (b) call the police on them. The situation is questionable even for a normal consumer, let alone a nervous one. Maybe most people will weigh up the situation and keep buying Apple. But they are making a choice, they aren't powerless. And some will start asking how important smartphones really are.

speleding• 5 years ago

I still hope there is a chance that Apple may change course after they realise they may not have thought this through very well.

Especially the argument that this can be weaponised really easily worries me, and it looks like they overlooked it.

For example: some joker sends you a Whatsapp with a lewd picture, WhatsApp by default saves all pictures to your photo roll => you are now on the naughty list.

I really hope they come up with a good answer to that one (or just abandon this unholy plan).

p2t2p• 5 years ago

I am cancelling my apple one subscription as we speak.

swiley3• 5 years ago

I completed my move to the Pinephone and formatted my iPhone over this. I'm probably not alone.

bArray3• 5 years ago

I was pretty convinced that people were taking Copilot seriously

I think people used Copilot and realised it was a bit of a nothing burger.

find a way to combat the real threat: life goes on.

That's the curse of the news cycle. But actions that do live on are monetary ones. When Apple miss sales targets, perhaps they will take note.

Your three bullet points are wonderful, and I agree entirely with them. And it won't change a damn thing.

I think the last one is the most important, if each of us here can multiply the awareness of the problem, we can start to make real difference. Tech people have a massive influence over what devices ordinary people buy, after all, who will they go to for tech advice?

I'm not sure what to do about it.

It's a tough problem, but what I do know is that doing nothing will 100% change nothing.

dmz73• 5 years ago

You can do two things: - fight : you will either join the establishment or have your life ruined but you won't change things - adapt : accept the things are the way they are and make the best of the situation In either case you can still get caught by the machine and get ground up, it has always been like that and as long as we are human it will always be like that. Any change that will happen is generational, 20 or 40 years from now the issues that are important to you now will be addressed by people who floated up to the top and are in position to make changes.

45ure2• 5 years ago

I'm not sure what to do about it

For starters, please give up the defeatist attitude. They deserve the frontlash; even if it serves no purpose, as you describe it.

Apple have placed 'Privacy' at the core of their messaging, in order to sell their high-end products. In comparison to the already excessive pearl clutching based on moral panic within the ecosystem e.g. sanitising and censoring language and apps. This is a scope-creep via thought terminating clichés like 'think of the children' and the boogeymen, which will not be enough of an explanation, when Apple ID's start getting locked out for capturing entirely innocent moments of their children's lives, or the intimate holiday snaps etc. Conversely, someone can weaponise it by sending you content that will besmirch your good name, or send you away for a stint in prison.

Nonetheless, they will be a couple of moves away from either a lawsuit/collective action or a pushback from consumers, especially when the algorithm (wrongly) labels you as paedo, porn baron or worse -- then placing you in a Kafkaesque nightmare to explain yourself.

https://www.apple.com/privacy/docs/A_Day_in_the_Life_of_Your...

flemhans• 5 years ago

I can't have a phone or a computer that snoops on me to this degree. So for me I definitely won't change or forget in a week. Unless they solve it, there's no more Mac or iPhone for me.

(This may actually be a Good Thing)

quickthrowman• 5 years ago

In reality, four weeks from now, do you think anybody will still be talking about it?

Nope, and it won’t have the slightest impact on Apple’s revenue or earnings either.

amarant• 5 years ago

Well, you can't save your friends, but you can save yourself: https://nixos.org/

charbonneau• 5 years ago

A typical defeatist neo-luddism stance. You are part of the problem.

Instead of spreading your nihilism, you could be a force for good. We are not powerless. We can make a difference.

Contact your elected officials. Start a movement. Create a direct competitor to Apple. I know it’s tough, but we all just need to come together and stop the negativity.

Excuses or results. You choose.

Sent from my iPhone

simonh5• 5 years ago

Like it or not, we aren't in control.

Yes you are. Leave the default and don’t enable this for your children’s iPhones, and the iMessage change won’t affect you. Switch off iCloud photo storage and none of your photos will be scanned. You have complete control over this.

delaaxe• 5 years ago

non-insignificant -> significant

bArray3• 5 years ago

I used a double negative on purpose there :)

intricatedetail3• 5 years ago

The problem with 1. is that a tiny amount of people understand or care about the issue. It won't make a difference to Apple bottom line. Then when other companies start doing it, you eventually become tech excluded.

This needs to be dealt with at legislative level.

mrweasel• 5 years ago

1. Vote with your feet - Put your money in the pockets of the people aligned to your values.

The sad reality right now is that we're actively suggesting that peoples stop buying smart phones, and I think that would mean that any argument will fall on deaf ears. Yes, projects like the PinePhone exists, but they aren't ready for the general public.

As much as I agree with your comment, the sad reality is that I have to pick between Apple and Google. Of those two companies I still trust Apple significantly more.

fragileone3• 5 years ago

That's not the only choice at all.

Pixel phones + GrapheneOS/CalyxOS. Various phones + LineageOS. Various devices + SailfishOS. Librem 5. PinePhone. Fairphone. /e/. F(x)Tec Pro1.

You're greatly underestimating the ability of people to adapt when suggiciently motivated, especially when so many devices can be bought fully set up and most people use only a few apps anyway.

mythz• 5 years ago

1. Vote with your feet - Put your money in the pockets of the people aligned to your values.

As much as I dislike this invasion of privacy, I still trust Apple's products, ecosystem & stewardship over the alternatives (for use by whole family).

Although this is the first time in recent memory where not having a viable alternative to consider is irksome as I don't see where the negative push back will come from to prevent further user hostile invasions like this - can only hope it ends here and it's not the start of a slippery slope towards govt surveillance.

laurent92• 5 years ago

The UK porn filter is already seeing works to extending to fighting against extremism on the Internet.

e-clinton• 5 years ago

What scare me is that now that this capability will be out there, a court could compel Apple to go a lot farther

bottled_poe• 5 years ago

1. Vote with your feet - Put your money in the pockets of the people aligned to your values.

This is impossible. Just like modern democratic voting, you don’t get to vote on an individual policy. You vote on a bundle and that bundle almost certainly includes policies (or in this case “features”) that you don’t agree with.

fragileone3• 5 years ago

So? If a corporation (or political party) does a shockingly egregious thing that doesn't align with your values then you absolutely should switch to an alternative that supports your values.

Krasnol• 5 years ago

1. Vote with your feet - Put your money in the pockets of the people aligned to your values.

Too bad many people have been trapped within the Apple bubble and are unable to jump ship because they have no idea how the rest works, how they get their data over there and don't have the time to do all this.

This is why Apple IS a monopolist and this is how it ends up being a problem.

snarf21• 5 years ago

I think the biggest challenge is a lack of consumer choice. Part of this is the complete failure of the FTC and the SEC in the 21st century. Maybe Pinephone will be compelling some day in the future but it isn't now. I don't want to be on tech support for my entire family trying to get some toy phone to work. We've built phones that are generally simple enough for a random grandma to do the couple things they need to do but the problem is to them FB, etc. IS the internet. That is where they see the pictures of their grandkids, they don't care about anything else.

I think there is a #4 that could be on the list. People within Apple could try to push back and protest and walk-out or any other means to try to make this fight go viral. However, the media and population write large will push back "... for the children." I've always thought that these problems are more solvable with Whistleblower Awards plus Witness Protection packages for the major enablers. There are lots of people in these rings or with someone who is but they are dependent on those same bad people for their necessities. Also, some of these rings are crime group adjacent and witnesses would need protection.

From what I'm reading, it seems like turning off iCloud (maybe just for photos?) will turn off this scanning. It is unclear to me what server side scanning Apple was/wasn't doing on photos uploaded to iCloud previously/currently. The one thing that occurred to me is that this is almost seems like this is a cya, Section 230 protection in disguise. There has been more discussions about Big Tech and 230, and this is one way to say "Look, we are compliant on our platform. Don't remove our protections or break us up, we are your friend!"

d0mine• 5 years ago

"vote with your fit" is as ineffective as taking less showers. It is a non-solution (what helps is growing less food in a desert, aligning government with the needs of most people)

simonh5• 5 years ago

That would be fine except an informed choice depends on accurate information, and this letter starts off saying things that are patently false.

“ Apple's proposed technology works by continuously monitoring photos saved or shared on the user's iPhone, iPad, or Mac. ”

No it doesn’t, photos just saved in the phone are never scanned by either of the systems Apple is implementing, and shared photos are only scanned in two very specific situations.

Also they avoid pointing out the iMessage aspect of this is opt in only, so it only applies to children and only if parents choose to enable it, and it's off by default.

You can completely avoid all scanning entirely by not opting in children for the iMesage scan, which is irrelevant to you if you don’t have children anyway, and not using iCloud Photo Library. Photos you keep on your phone or share using other services will not be scanned. Anyone just reading this letter wouldn't know any of that. How is this promoting informed choice?

Bear in mind the iCloud Photo Library scan is being implemented in order to meet a legal obligation. Apple is required by law to scan photos uploaded to their cloud service.

So really there are two issues here. One is the question of parental authority over optionally enabling the scan for their children’s use of iMessage. That's a legitimate concern over the privacy of children, no question.

The other is whether this is an appropriate way for Apple to comply with US law requiring scanning of uploaded images, and whether that law is appropriate. Again, entirely legitimate concerns that this letter obfuscates completely.

ajconway• 5 years ago

Probably the main issue is that every time a technology or regulation that starts like that (“you don’t need to worry if you’re not doing anything wrong”) is then inevitably expanded into repressive activities by governments around the world.

ksec• 5 years ago

I actually view this as not a good sign. That many are still in the very very early stage of shock, what Apple is doing does not align with their perceived values. Deducting points from Apple in their own mental model. They write these letter because they think Apple is still mostly good and hope they could have a change of heart.

What would happen as some others have pointed out, people will forget about it. Apple will bump out decent Mac products line, along with very good iPhone hardware in a few months time. Which will add points back to their mental model.

"May be Apple is really doing it in good faith"

"They aren't so bad, let's wait and see."

Apple's marketing and PR have changed in the past 5 - 6 years. My guess is their KPI had changed. And they will ( successfully ) white wash any doubt you have. And 2022 Q1 results ( That is the iPhone 13 launch quarter ) will be record breaking again.

And that is not even including competition. I mean for pete sake is Microsoft or Google even trying to compete? ( I give credit to their Surface Laptop and Pixel team, but still far from enough )

busymom0• 5 years ago

Fair point and you are probably right. However, this is getting them a ton of bad press from pretty major players in the privacy world (Edward Snowden for example). This has high chances of a lot of people abandoning Apple products (I'll no longer purchase new apple products and already switching over to de-googled Android).

Privacy is obviously just a marketing play by Apple but this time, they can't hide it and it might actually hurt their bottom line.

fsflover2• 5 years ago

I mean for pete sake is Microsoft or Google even trying to compete?

Forget the evil monopolies. Consider GNU/Linux phones, Librem 5 and Pinehone. They may not be ready for an average user, but the HN audience can take advantage of them and help their develoment.

nicce9• 5 years ago

It might be hard to understand, but iOS is a blackbox. Based on what they add and say, we still don't know what exactly is happening. All we have is trust. We can speculate that with "what ifs", but same "if" is applying already.

Once we take other big platforms on account, Apple is actually trying to note privacy. Other platforms just scan everything you put in cloud, but Apple tries to limit the information what they acquire, by scanning it on device. And based on their specification, they scan locally only what is going into the cloud. It took me a while to realize, but this is improvement for what has been happening in the industry for years already.

walshemj• 5 years ago

Depends Apple is on my "call first list now" on my CV along with Chem and Bio weapons and payday loan type companies.

And I wont be buying the ipad I was thinking about.

fibers• 5 years ago

with regards to #1, that is what I did last year when I chose to buy apple since safetynet would mean i would be completely hosed in buying a phone that works with privacy centered custom roms while also using important apps. now that apple is completely breaking user trust where you you possibly think people can 'vote with their feet'? this is a libertarian fantasy other than simply not using smartphones altogether?

kktkti93• 5 years ago

Apple has a right to protect themselves from being an accomplice to distribution of child porn.

Maybe you freedom fighters should have heeded the warnings over the decades of creeping corporate control and stopped buying their products?

Oooh but that dopamine high from new stuff is so addictive!

Now you’re finding yourself in an overturned boat, adrift at sea, no life jacket, and you’re ready to take on monopoly?

The anti-politics bloc incensed their political hands off approach enabled others to wield politics against them.

Good luck.

seanp2k28• 5 years ago

The thing that gets me about #1 is that if I prefer iOS to Android, there is nothing that can replace iCloud. Google Photos and other apps cannot upload seamlessly in the background as iCloud can. I cannot “restore my iPhone” from a Google Drive backup. Apple uses private APIs for their own software to enable this, so now I must either use iCloud and accept these terms, or make iTunes backups regularly + deal with the inconvenient workarounds required to let things like Google Photos sync everything.

Given that there are two realistic choices in mobile OS these days, both bound to hardware (and update schedules to a combination of mfg + carrier whim), it’s not a great position to be in as a consumer. And yet, what is the alternative? PinePhone?

toastal2• 5 years ago

Don't support Apple! *You must sign up for a Microsoft GitHub account to sign our petition.

While I like the sentiment of protest, I don't understand this logic of putting it on a closed platform of one of Apple's biggest competitors who also doesn't respect your privacy.

fouc2• 5 years ago

You made me ponder about "Microsoft Github account" vs "Github account", or large corporation vs smaller corporation. So many smaller corporations end up getting acquired by larger corporations anyways. It's all kind of a broken system huh?

toastal2• 5 years ago

I wish I would practically escape it. On personal projects, I’ve moved everything to Sourcehut and GitLab, but so many projects I want to contribute to are still on GitHub for legacy reasons and don’t feel it’s worth the effort to migrate (though everything heavy on the libre side have moved). Some projects, like Elm (programming language), use GitHub for both as the source of its package management and identity so it’s impossible to escape the lock-in.

But this is why Microsoft bought it: to get closer to monopoly (GitHub, Copilot, NPM, VS Code, Azure, etc.) making people buy into a platform they feel they cannot escape. I think it is important to tag the parent company when talking about GitHub so users understand who they are really dealing with by hosting their projects on this Git forge and what restrictions this puts on their contributors.

jasonlfunk3• 5 years ago

I’m not sure what to think of the backlash here. I’m sure that people aren’t trying to minimize the evil of child pornography and exploitation. But anything that has the potential to stop or slow it should be fairly considered. People complaining that Apple is scanning your photos, they are already doing that. Where was this backlash when they released the memories feature? Why is scanning your photos for good pictures of your dog different that scanning your pictures for exploitive pictures of children? Is the problem that they could then share that information with the authorities?

But of course this feature could be abused. But Apple already has all the power it needs to be abusive. They can push whatever software they want to your devices. They can remotely lock and wipe all your data. They already have the power to do all of these things. This statement is simply an announcement that they will be using some of this power to try to stop one of the worst evils in our world. Until they prove that they will abuse this power, I suggest that we let them try.

xvector2• 5 years ago

The concern is less about outing people with CSAM and more about Apple building a powerful tool for government surveillance that will most certainly be abused by countries like China and Saudi Arabia when they request that politically dangerous images be added to the database if Apple wants to continue business in their country.

It is incredibly myopic of Apple to implement this feature. You must consider, as an engineer, how your constructions will be abused and used for bad as well as good.

simondotau3• 5 years ago

This isn't a powerful tool, it's more akin to a rudimentary hash check. It's not going to match photos that aren't already known to authorities. And any time a user is flagged, the material in question is sighted by an Apple employee before a decision is made whether to forward it onto the relevant authorities.

hvocode• 5 years ago

I think the point is that yes, they have always had the power to do these things - but they haven't thus far. We rely on entities with power (companies, governments, people) to exercise restraint in how they exercise it. Those that DO exercise restraint gain trust since exercising restraint demonstrates an understanding of the consequences of not doing so.

What the Apple move is doing is showing that they are willing to relax their restraint. It gets tricky because everyone agrees that the specific goal here is honorable, but the manner by which they are using their power to achieve it is generalizable to areas that are less honorable. Once they are willing to use their power to accomplish one highly honorable goal, it's not a big ask for them to use it for a slightly less honorable goal in the future. Iterate that a few times and you can find yourself in a very bad place. It's the classic slippery slope argument - when you know there is a slope that leads to dangerous places, you need to not ever start down it no matter how righteous the motive is in starting down that path in the first place. There's a reason we have the old saying "the path to hell is paved with good intentions".

The existence of power isn't what matters: it's the intention and willingness to exercise it. Apple is now demonstrating that they have changed their stance in how they choose to exercise their extreme power. That's worthy of scrutiny.

For a concrete example of where I expect this to naturally lead to: instead of a database of child pornography being the source of the hashes to search for, the Chinese government provides a set of hashes of all known digital photos of the Tianenmen square protests of 1989. Does it really seem implausible for a government like China's to NOT use this kind of technology for that purpose? It's not hard to cook up similar examples all over the place.

jasonlfunk3• 5 years ago

Yeah, but they are already doing this for pointless things. They already use facial recognition on all the photos on your phone. That’s what I don’t understand. The only new thing is what they are looking for and their willingness to alert the authorities. The slippery slope argument that this will eventually be used by China to arrest journalists is scare tactics. We have zero evidence that Apple would allow such a thing to happen. And the only thing stopping them is Apple’s word. The fact that they are announcing this should actually give confidence that they aren’t doing it in the shadows for China. They didn’t have to say anything about this. The fact that they should give you confidence that they are respecting your rights, not evidence that they aren’t.

dmitrygr5• 5 years ago

  But anything that has
  the potential to stop
  or slow it should be
  fairly considered

Strip searching everyone hourly will stop most contraband, including child pornography. And, according to you, it should be fairly considered.

Shall we start with you?

(And as people do have naked photos of themselves on their phones often[1], make no mistake, the strip search analogy is NOT an exaggeration)

[1] https://en.wikipedia.org/wiki/ICloud_leaks_of_celebrity_phot...

jasonlfunk3• 5 years ago

Considered, sure. But easily rejected. Let’s be grownups here.

KONAir• 5 years ago

If UN or another international body like Interpol suddenly grew the courage to do it planetwide, I'd be the first to volunteer.

matwood8• 5 years ago

It's important not to conflate the new features. CSAM uses hashes of known photos and is only run on photos going to iCloud (turning off iCloud turns off CSAM). Photos sent to iCloud have been checked against CSAM for years on the server. The change here is moving it from server to client (which I hope is to make iCloud photos E2E encrypted).

Completely agree with your second point. All the 'what ifs' have existed forever. Either iOS users trust Apple will only do what stated or they don't. Nothing has changed.

ssss113• 5 years ago

Related but slightly off-topic: am I the only one that thinks more technology is not the answer to catching crooks? Can’t the police do good old fashioned police work to catch people doing these things? Why does EVERYONE need to be surveilled for the 0.01% (or less?) who don’t behave properly. To further this point: why do we need cameras on every street, facial recognition systems and 3-letter orgs storing huge data silos and maintaining lists etc etc… One thought: is it because over 10, 20, 30+ years the police have been de-funded everywhere and become useless for difficult cases and/or militarised to deal with peaceful protesters instead? Genuine questions.. I just don’t think this surveillance nightmare is the answer, and police could still catch crooks before the internet so what’s the problem.

pydry2• 5 years ago

One thought: is it because over 10, 20, 30+ years the police have been de-funded everywhere

Police funding has shot up in America. It's everything else thats been cut.

what’s the problem.

There's no problem. It's just a drawn out power grab with a weak pretext.

adventured• 5 years ago

Police funding has shot up in America. It's everything else thats been cut.

What else in America has been cut? I'd be interested in that very long list (since you're saying that everything else is seeing cuts; the understood meaning being that a very large number of major items are seeing their budgets slashed). The spending data I see year in year out, or across decades, is showing the opposite.

Healthcare spending has skyrocketed over the last 20-30 years, including healthcare spending by the government (eg Medicaid, Medicare). They're not slashing Medicaid or Medicare, those programs have far outrun inflation and are drowning the US budget.

Social Security hasn't been slashed. Even the leading Republicans no longer dare talk seriously about cutting Social Security (30-40 years ago they commonly did). Trump could hardly run away faster from that conversation, it's the third rail of US politics, absolutely nobody dares.

Education spending has not been slashed. US teachers are among the best paid in the world and Americans spend more per capita on education at all levels than just about any other nation (while getting mediocre results for their epic investment, as with healthcare spending).

Defense spending of course continues to rise.

The US welfare state has continued to perpetually expand. US social welfare spending is larger as a share of GDP than it is in Canada; and it's closing in on Britain (the US will catch Britain on social welfare spending as a % of GDP this decade). The US social safety net has gotten larger, not smaller, over the decades. Programs like housing first didn't even exist 30 years ago; food security programs like SNAP continue to get bigger over the decades, they're not vanishing.

US Government spending has continued to soar year by year. Typically 5-8% annual spending increases are normal (just look at the radical spending increases during the Bush and Obama years, or any of the recent budgets). Total government spending (Federal + State + Local) has continued to climb, it has not been slashed or reduced. Total US government spending is taking more out of the US economy than it ever has outside of WW2 - you have to go back to WW2 level spending to find something comparable.

Total US government spending has increased by roughly 225% over the past two decades (more than triple the rate of inflation over that time). The soaring spending shows no sign of letting up.

The major US Government agencies - such as NASA, NSA, FBI, DHS, VA, DoJ, etc - have not had their budgets slashed over the last few decades, they keep climbing year after year.

The only big one I can think of is infrastructure spending, which has not kept up with inflation because both sides have refused to raise gasoline taxes.

What kind of results do we have to show for the massive increase in government spending? Are our streets now lined with gold? Things are better than they have ever been, is that right? Is our quality of life equivalent to Switzerland, Norway, Denmark, Sweden? Because we now have their per capita government spending levels. The government systems of the US are spending the equivalent of 45% of the economy each year.

hoppyhoppy2• 5 years ago

There's no problem. It's just a drawn out power grab with a weak pretext.

In 2018 tech companies reported over 45 million images of CSAM, which was double the amount that was reported the year before.[0] The next year the number of reports went up to 60 million.[1] I wouldn't expect everyone to agree on the proper response to the rapid growth of child-abuse imagery online, but I don't think the problem itself should be dismissed.

[0] https://www.nytimes.com/interactive/2019/09/28/us/child-sex-... or https://web.archive.org/web/https://www.nytimes.com/interact...

[1] https://www.nytimes.com/2020/02/19/podcasts/the-daily/child-...

hellbannedguy• 5 years ago

We hire, and train, terrible cops in America.

They are basically Reveune Collectors.

I would like to see all cops under federal jurisdiction. Let the FBI train them.

I know in my county of Marin we have way to many just looking for any slight moving violation.

I have felt for awhile that we also need complete bans in certain kinds of tech.

With the exception of always on cop cameras.

judge20208• 5 years ago

Exactly, there's a reason the FBI takes over real criminal cases when they occur - the police are just there to settle petty, inconsequential local disputes.

PartiallyTyped3• 5 years ago

For what it's worth, police funding in US rivals and exceeds military funding of other countries.

borski• 5 years ago

Asking in earnest: are you speaking in absolute terms or relative terms? That is, does the percentage of funding (as compared to the rest of the budget) exceed most other countries’ military funding, or just the absolute amount?

CSAECop13• 5 years ago

"Can’t the police do good old fashioned police work to catch people doing these things?"

I'm a detective that works exclusively on online child sexual offences.

The short answer to this is "no", although the question doesn't make much sense to me. Policing has always been near the forefront of technology.

Perhaps you could expand more on what "good old fashioned police work" means, in this context?

ssss113• 5 years ago

Thanks for your reply - I meant that police caught criminals before the internet (I do not know the effectiveness and am unknowledgeable on this subject generally), however they did that, getting out there speaking to suspects and victims, and investigating with evidence I would guess

lovemenot5• 5 years ago

Do you have any qualms?

For you does the CP protection end justify any means?

Where would you personally draw the line on mass surveillance by LE for the sake of your specific LE goals?

CP aside, are there other crimes that you feel should be folded-in to a dragnet like this?

feanaro11• 5 years ago

Not the OP, but by good old fashioned police work, I assume non-dragnet methods, where everybody's device isn't scanned in an automated way. So instead of sifting through a massive collection of automatically collected data, taken from a vast majority of innocent people, you'd deal with explicit reports of CSAE. You'd then be able to get a warrant to obtain ISP (and other) records, cross-reference and proceed from there. If there's reasonable suspicion, you'd get the suspect's address and go talk to them in person.

Before we started trying to push government-sanctioned and unwanted spyware engines on private devices, I imagine the process looked something like that. Is this incorrect?

stjohnswarts4• 5 years ago

First very brave of you to post here and thanks for that. Second thanks for all your hard work in keeping this world sane. However, I would point out that this is a complete invasion of privacy and essentially working around the 4th amendment in both spirit and the law via using Apple as a proxy to spy on us. I realize police just want to do their job and have to push on the limits, but with all due respect I think this is going too far. That's why we push back when something as ridiculous as this happens. I don't want to be policed on my own devices, and the only way police should have a way into that is with a warrant, then you can drop a world of security on me. The pedos will just work around this and this is the first step into allowing police into all our personal devices while the criminals work around it. Anyway, again I mean this in a respectful tone, I just think it goes way too far. Cloud drives are already being scanned and that's with corporate permission on their own devices, so that's tolerable if undesirable but what Apple is doing here is going too far.

lyaa• 5 years ago

American police has never been de-funded, and if you really think "good old fashioned" police work ever actually worked for most people, you are misinformed.

Without even discussing policing across racial and poverty lines, one only needs to look at police failing to catch serial killers, rapists, and even just house burglars.

The situation was much worst 10, 20, 30+ years ago. Nowadays police have some of their work done for them by technology and they are at least able to catch a few more criminals. Technology has also helped prevent false arrests in some cases. Apple's content scanning is problematic, for sure, but technology in general has been great for community safety.

ssss113• 5 years ago

Thanks for sharing your knowledge, yes I am fairly uninformed about police effectiveness which is why I wanted to find out more.

CSAECop13• 5 years ago

I don't know why this is downvoted, you are absolutely right.

Prosecutions based, essentially, on community suspicion are what lead to countless black men being wrongfully convicted of the rape of white women.

Police embracing cutting edge science like DNA sequencing is what allows unreliable antiquated evidence like (gasp) eyewitness testimony to be given it's proper weight.

Perhaps people consider DNA evidence to be "good old-fashioned policing" nowadays but it was within people's lifetimes that it was as new was quantum computing is today.

The sooner the "good old fashioned policing" meme dies the better.

stjohnswarts4• 5 years ago

I don't think us have thought criminal scanning on our devices is going to fix any of that. Cops don't need to be in my phone unless they have reason to suspect me and have a warrant to search it. Otherwise this is just a corporate proxy for the cops in warrant-less searches of what we're doing day to day on our own devices.

noobermin• 5 years ago

I don't think police has been defunded more than the funds have been put into unnecessary things like surplus military gear, settlements to defend the vast minority of bad cops, etc. That takes the oxygen out of everything including what most people consider fair police work.

csomar• 5 years ago

Can’t the police do good old fashioned police work

There is no "old fashioned" work. The police is a relatively new concept. And these issues (Child Porn) are really 21 century issues.

Why does EVERYONE need to be surveilled for the 0.01% (or less?) who don’t behave properly.

Because you think they are surveilling people to catch the bad people. You have too much faith in the system.

komali2• 5 years ago

Where are you hearing that cops are getting defunded? The curious should look up the budget of the NYPD and LAPD looking mighty funded to me!

that_guy_iain• 5 years ago

Well what they’re searching for is done privately and the victims often don’t go the police. And good old fashion policing was to ignore these crimes.

doubtfuluser2• 5 years ago

Most of the people see the adversary in Apple (or governments), I think there is something else: What about Adversarial Attacks. Let’s assume someone is going to spread regular memes modified as Adversarial examples to generate the same neural hash as the true bad images. Thinking back at the political campaigns, these could spread very easily among some voters for some party. Suddenly you have a pretty serious attack on people of some political spectrum (or whatever group you can target with this)… I seriously think this wasn’t fully thought through.

dcow5• 5 years ago

…Maybe we should? All it would take is someone publishing the hash database and then another group working to generate hamming-similar images. Shouldn’t be that hard if it’s as broken as people claim. What’s that saying, “can’t outlaw something that is commonly acceptable behavior”? Point being attacking the system would either prove or compel the false positive rate to be “acceptable”, or result in it being dismantled. Still ideologically opposed but this may be a practical “solution”.

ursugardaddy• 5 years ago

It requires a 'collection' of images to trigger an alert to apple who then has someone manually reviewing the photos before taking further action

there's still our justice system/due-process as well

blazespin• 5 years ago

Horrible. Apple has every right not to facilitate child exploitation, your rights be damned. Don’t like it? Don’t buy an iPhone.

end of story.

b0afc375b5• 5 years ago

Four of the top ten posts as of writing is about this issue. I'm glad people are finding something they are interested in to talk about, but at this point this issue is hardly intellectually interesting.

It's like people are being forced to buy an iPhone or something.

beermonster• 5 years ago

I guess a lot of owners of Apple devices are also making use of a lot of their services/features making it hard, or at least inconvenient, costly and time-consuming to switch out i.e. vendor lock-in with open alternatives. This is why it's good to try to avoid this situation occurring in the first place. But that's at odds with how you're 'supposed' to use their devices and ecosystem and you may as well have not chosen Apple in the first place. Most people have already gone 'all-in'. Too bad when they implement something (like this) that could be used to target innocent people at some point in the future. Apple obviously don't intend it to be used in this way. But a bit like the Pegasus debacle with it only targeting criminals, it's obviously a vulnerability waiting to be exploited.

Nginx4874• 5 years ago

So we should sit still and wait while CCTV in every room would be a normal preventive measure against child abuse? No thanks, we will tear down this initiative, and will keep doing that in future. However, you can keep sending your private footage to the police station, if you like doing so.

Synaesthesia• 5 years ago

I think the important question is, can we trust a large company like Google, Apple or Intel again in the future, and how do we know that they're not spying on us?

lovelyviking5• 5 years ago

I think at this stage big companies affecting societies in a big way may be forced to publish source code that people of those societies run on their personal devices. At least the client side.

lovelyviking5• 5 years ago

At this stage it doesn't matter if it is carefully calculated effort to gradually strip off people from the very sense of any privacy with longing effects on a society (like I described here [1]) or it's some company trying to legalize Spyware Engine for it's own convenience covering it with some story to justify it. Usually they use children for such cover story because people have direct emotional response to that topic and thus stop thinking for just enough time to miss the important issue.

The important issue here is an attempt of Spyware Engine installation/legalization on personal device.

I think this is much more serious than many people might see it at the moment. I think it is attack on a very fabric of free democratic society where human rights have real meanings. It is done by people who do not share those values or not familiar with them or simply do not care about them or even worse - doing it on purpose.

Many can think of their personal device as their home. Some can even think of it as extension of their mind. It is very personal space and attempts to invade it can/should be considered not less serious then invasion into your private home.

Even critics can admit that your personal device indeed can be in your private home space and connectivity of such personal device should not automatically mean that someone or something like AI under control of someone should access it and spy on you without warrant.

Companies are doing shitty things for some time now and they are getting away with them. This can be a reason why they move forward with unacceptable practices of surveillance. Perhaps those companies do not understand that surveillance is completely incompatible with free democratic societies respecting human rights and there is no way they can succeed in combining two incompatible things unless they wish to repeat China way of doing thing. And I believe the later would not be met gladly I even think not so much possible without using firearms to which people would resist with the same effort like they did many times in history to protect own freedom.

At this stage I think it is much more serious than just writing a letter.

There should be a law protection of your personal computer from any Spyware Engine/Agent for any reason other then warrant to avoid bigger and possibly deadly confrontations. Just like your home as your personal space should be protected from Search without warrant in Fourth Amendment [2]. Your personal device is much more personal then your home in a way and deserve to be guarded accordingly. I am not a lawyer and perhaps Fourth Amendment is already enough but then it should be used properly to prevent Spyware Engines in personal devices.

* Amendment IV

The right of the people to be secure in their persons, houses, papers, and effects, against unreasonable searches and seizures, shall not be violated, and no warrants shall issue, but upon probable cause, supported by oath or affirmation, and particularly describing the place to be searched, and the persons or things to be seized. * [2]

The Fourth Amendment originally enforced the notion that “each man’s home is his castle”, secure from unreasonable searches and seizures of property by the government. It protects against arbitrary arrests, and is the basis of the law regarding search warrants, stop-and-frisk, safety inspections, wiretaps, and other forms of surveillance, as well as being central to many other criminal law topics and to privacy law. [2]

[1] https://news.ycombinator.com/item?id=28084578

[2] https://www.law.cornell.edu/constitution/fourth_amendment

tcldr2• 5 years ago

So, if I understand correctly, the NCMEC provides a bunch of hashes of CSAM for Apple to match. This way Apple doesn’t get exposed to the content of images themselves? Then Apple will provide a user’s details plus the IDs of matching content. This identifies the direction of travel for any CSAM content?

So, now NCMEC and any local NCMEC can provide new hashes and identify – possibly even historically – the epicentre of the distribution of a group of images.

Except, if Apple only gets the hashes, what’s to stop a bad actor in a NCMEC from providing non CSAM images to Apple for other purposes?

Seems like this technology should be illegal without a warrant. It’s a wire tap.

0xy3• 5 years ago

NCMEC's database already contains non-CSAM. What you suggest is not theoretical, it's reality today.

I really think people are missing this point. NCMEC's database is not an infallible, audited and trustworthy source of despicable imagery. It's a mess contributed to by thousands of companies, individuals and police.

It's also so intertwined with the FBI that I don't think it's truly correct to call NCMEC independent, given FBI employees work at NCMEC, including on the database.

The FBI's involvement is particularly notable here, given their past usage of mass surveillance.

This is a truly terrifying precedent.

tcldr2• 5 years ago

Wow.

Also, many people trust Apple to do ‘the right thing’. But if Apple are trusting NCMEC and their local equivalents to provide valid CSAM hashes, Apple will never know if their technology is being abused, so they can conveniently point the finger elsewhere if it is.

I can’t imagine this point has escaped their awareness.

tpush• 5 years ago

NCMEC's database already contains non-CSAM.

How do you know?

natdempk• 5 years ago

Can you provide more context for this? I could definitely believe this possibility but it’s a big claim to make.

judge20208• 5 years ago

What you suggest is not theoretical, it's reality today.

As others have stated, do you have proof? Inside knowledge of this supposed reality? Even some major news publication with no direct evidence would be credible enough to support this statement.

NotChina2• 5 years ago

It's really hard to not want to throw some Schadenfreude on those who pay mini-bar prices for technology. Sadly I doubt this will be a last straw for most, given their investment in time standing in lines.

Klonoar3• 5 years ago

This letter doesn't really read correctly. If you're going to write an open letter, this might be better worded.

Apple's proposed technology works by continuously monitoring photos saved or shared on the user's iPhone, iPad, or Mac.

It does a check if it's being uploaded to iCloud Photos. It is not (currently, at least) continuously monitoring photos saved or shared; shared is Messages specific for child accounts.

Because both checks are performed on the user's device, they have the potential to bypass any end-to-end encryption that would otherwise safeguard the user's privacy.

There is currently no E2E encryption for iCloud, so short of HTTPS... what is this supposed to mean? There is literally no privacy at all if you upload to iCloud currently.

If anything, it feels like Apple's client side system enables something closer to E2EE while maintaining the ability to detect child porn on their platform.

jpxw5• 5 years ago

Yes, there seems to be a lot of conflation between the two separate systems (in the media, and in comments on here).

As you say, it’s important to be precise, otherwise people won’t take your arguments seriously. To summarise:

One system involves hash checking. This is performed when photos are being uploaded to iCloud. The hashes are calculated on-device. Private set intersection is used to determine whether the photos being uploaded match anything in the CSAM hash list. Photos that match will be reviewed manually - if I recall correctly, this only occurs after a certain threshold has been reached. This system will only match known CSAM (or whatever else is in the hash list).

The second, independent, system, is a machine learning model which runs on-device to detect sexually explicit photos being received on Messages.app. This system is designed to be run on children’s phones. The system will hide these explicit images by default, and can be configured to alert parents - that feature is designed for under-13s. This system doesn’t use the CSAM hash list.

matwood8• 5 years ago

Based on my reading, the first system is interesting in that the threshold is also cryptographically determined. Each possible hit forms part of a key, and until a complete key is made none of the images can be reviewed.

Should also be noted the second system sends no images to Apple or is reviewed by Apple employees in any way. It's just using the same on device ML that finds dog pics for example.

I think Apple PR screwed up here announcing all these features at once on one page, and not having the foresight they would be conflated. It also didn't help that a security researcher leaked it the night before without many of the details (iCloud only for example).

Context should also be included. CSAM has been happening for years on most (all?) photo hosts, and is probably one of the blockers to full E2E encryption for iCloud photos (I so hope that's coming now!).

Finally, nothing has really changed. Either iOS users trust Apple will use the system only as they have said or they won't. Apple controls the OS, and all the 'what if' scenarios existed before and after this new feature. As described, it is the most privacy preserving implementation of CSAM to date.

nullc10• 5 years ago

Photos that match will be reviewed manually

This isn't a protection of your privacy. It's because US v. Ackerman (2016) the appeals court ruled that when AOL forwarded an email with an attachment whos hash matched the NCMEC database to law enforcement without anyone looking at it, and law enforcement looked at the email without obtaining a warrant was an unlawful search and had AOL looked at it first (which they can do by virtue of your agreement with them) and gone "yep, thats child porn" and reported it, it wouldn't have been an unlawful search.

Instead, if Apple were to report the existence of a match to law enforcement without divulging the image, which (if the matching is precise enough) should be enough to create probable cause to allow law enforcement to obtain a warrant. The only once a warrant was issued would anyone look at the image. That would be more protective.

What they're actually doing just inserts an unaccoutable additional step that reduced your privacy for the specific purpose of undermining your due process by avoiding the need of law enforcement to evade your privacy.

lovelyviking5• 5 years ago

If you're going to write an open letter, this might be better worded.
It does a check if it's being uploaded to iCloud Photos.

The letter has a perfect wording because it doesn't relay on things unknown or said by the interested side with agenda to push Spyware Engine using some BS cover story. Wording reflects the real danger of such step.

Your continuous attempts go into tiny little details of what Spyware Engine would do at the first stage and support this BS cover story about children is irrelevant to the problem. Besides, How do you know? Did you see the source code?

This cover story has nothing to do with the issue and invented to get emotional response from people and make them stop thinking about what is actually happening.

And what actually happening is an attempt to legalize Spyware Engine that will do completely other things that are claimed and who knows what it will do...

We are not that naive to believe for a second that this Spyware Engine is going to do what it is claimed to do. This attempt of it's legalization is done just to avoid future scandal once it detected.

Again, it doesn't matter what Spyware Engine would do at the moment of installation. What matter is it's existence on a personal device which should be prohibited completely. No one in healthy mind would believe that even if Apple would say that Spyware Engine would not be installed it would indeed not be installed. It should be checked very carefully. It very may be already installed. The fight now is more about legalization of it and values. Not about Apple. Not about what their specific version of Spyware Engine does.

There is literally no privacy at all if you upload to iCloud currently.

This is exactly the reason why some people do not use iCloud and not going too. The whole idea of putting personal thoughts/ideas/photos into some cloud in open/de-codable format is completely idiotic. So I agree that this malicious practice is done for some time now by Apple . It is unacceptable. It was encouraging people to loose own privacy which is the opposite of what should be in a healthy free democratic society respecting human rights. It was bad long enough but now there is an attempt to make it even worse, because before at least people had a choice to avoid using iCloud and not participate in malicious Apple activity but now it is suggested to leave people without such choice because Spyware Engine is pushed to be installed in their personal devices.

The installation of Spyware Engine will have longing effect on free democratic society respecting human rights. I described such effect here: https://news.ycombinator.com/item?id=28084578

jpxw5• 5 years ago

Unpopular opinion: I think the outrage over this is quite overblown.

This kind of hash checking is done by damn near all cloud providers - Google Photos, Dropbox, Gmail, Discord, Reddit, OneDrive, Facebook, Twitter, you name it. Apple have actually been very reluctant to implement this.

If you don’t like it, you don’t need to enable iCloud Photos. In the exact same way as if you don’t want your images scanned by Dropbox, you don’t upload the photos to Dropbox. It seems reasonable for Apple to implement something like to prevent iCloud becoming a repository for CSAM.

Edit: I’m unable to respond to the comment below this about hashes being performed locally, as I’m rate limited, but here’s my response anyway: The hashes are calculated on the local device, but only for photos which are about to be uploaded to iCloud Photos. The hashes are sent with the photos to iCloud. If a certain number of hashes in someone’s iCloud match (calculated using private set intersection), a manual review will be performed.

thinkingemote• 5 years ago

It's being done on the local device, not just the cloud.

marcellus234• 5 years ago

Why does it matter where the scanning is done, if the scans are done to the same content under the same circumstances?

matwood8• 5 years ago

Not sure why you're downvoted (too many facts in one post I guess lol), but you're right. I wanted to add that Apple has already been doing CSAM scanning on photos uploaded to iCloud for years. They moved it to the client instead (I think in preparation in make iCloud photos e2e encrypted).

Turn off iCloud photos and it turns off CSAM.

nbzso4• 5 years ago

Apple is forgetting the network effect of professionals that made them billionaires. I personally evangelized my clients in the past for years to switch to Apple ecosystem.

In my view this is weaponization of personal devices on a mass scale with clear intent of normalization of surveillance state on a global level.

The fact that this comes after NSO spyware investigation speaks volumes. They don't care about privacy. They care about control over user data.

I hope this will give power to Linux and FOSS movement and be the beginning of serious Apple detox.

lovemenot5• 5 years ago

The empowerment that you feel you once lent to Apple may no longer be part of their growth plan. Whether or not it actually mattered at the time.

nbzso4• 5 years ago

The empowerment at the time was a honest and professional assessment of using MacOS X vs Windows. Apple embraced PC vs Mac marketing as I can remember.

The empowerment today is the same professional stance. Explaining the technical facts to my customers. Nobody will like the idea that their phone or personal computer will actively police on the behalf of big brother.

Serious business people don't have to "follow" tech closely. That's why they pay us.

parasubvert3• 5 years ago

As a fellow professional, I think this is kind of nonsense.

Apple (and all these companies) also operate in a world with a populace that WANTS surveillance for these areas, does not agree that it is a slippery slope, and has voted in governments where that eventually will force Apple to install an even worse back door.

The Linux and FOSS movement have never been up to the end user device challenge, and they too operate in a world with a populace that WANTS surveillance for this stuff.

The solution to true privacy is never going to be “switch to FOSS” for most users, as that’s sort of like saying “get a degree in math”. It will work for some, but it will be an unstable experience.

The solution has to be to a) ensuring democracy survives and b) convincing most people that the right to privacy is more important than finding child pornographers, and c) to vote for representatives that will uphold that right.

nbzso4• 5 years ago

Sorry. I am biased on "political" solutions. In the country where I live politicians are just mercenaries for hire.

Most of them are direct successors of communist apparatus or political project of inner circles with economical power.

Looking at the EU legislators, they will like Apple idea a lot, so my options are limited to technical evangelism for people that care.

jwildeboer• 5 years ago

To introduce such invasive technology just a few weeks after the Pegasus scandal shows me that Apple has lost its ability to read the room.

nullc10• 5 years ago

https://www.apple.com/child-safety/pdf/CSAM_Detection_Techni...

Apple uses sophisticated cryptography to make absolutely certain that you cannot hold them accountable for abuses of this system against you, NONE of which are prevented by its complex construction.

The private set intersection is an alternative to sending you a list of bad-image hashes which uses significantly more bandwidth than simply sending you the list. This alternative is superior for Apple because if they distributed the hashes it would be possible for someone to prove that they had begun matching against innocent images (such as ones connected to targeted races or religions, or sought to out particular pseudonyms by targeted images connected to them). It is inferior for the user for precisely the same reasons.

Some might be fooled into thinking the "threshold" behavior, somehow is in their interest: But no, Apple (or parties that have compromised them) can simply register the same images multiple times and bypass it and the privacy (for apple, but not for you) makes it impossible to detect that they've done that.

lovelyviking5• 5 years ago

The existence of Spyware Engine is a problem, not technical details of how current version suppose to work. Suppose to work because we have not idea what it will do. Did you see the source code?

We are not that naive to believe for a second that this Spyware Engine will do what is claimed.

This is simply viewed as calculated attempt to legalize Spyware Engine on a personal device covered by some bs story intended to get emotional response from the audience to fog the real issue. It is always done this way so no surprises here. All limitations of free speech on the web in Russia were done under umbrella of protecting children and immediately used against political opponents to this very day.

This is discussion about values [1] not technical details! Simply because Spyware may be already installed. It should not become any legal though or morally accepted anyhow.

[1]https://news.ycombinator.com/item?id=28084578

nullc10• 5 years ago

I agree with you, but if you'd take the time to read my post you would see that I am arguing that it's not good even by their own claims!

They talk a lot about complex crypto to protect privacy but the primary thing it's doing is hiding what apple is matching against, which shields them against accountability.

I fully agree that even if the behavior were currently threading the needle it would still be an extremely bad move.

See also this prior post of mine: https://news.ycombinator.com/item?id=28083838

judge20208• 5 years ago

No, the existence and non-existence of a spyware engine doesn't constitute a problem. These companies spend billions of dollars, paying thousands of engineers a year, to develop solutions to problems that often don't even exist. It's safe to say that the sheer scale of every one of these tech companies means that this isn't something that incrementally gets worse, within a 6 month sprint they could push an update overnight going from step 0 to step 5 of total spyware.

Grustaf5• 5 years ago

The private set intersection is an alternative to sending you a list of bad-image hashes which uses significantly more bandwidth than simply sending you the list.

How can the image hashes take up more space than the images themselves? Are you sure about this?

Jolter4• 5 years ago

That’s not what they wrote, double check your comprehension.

nullc10• 5 years ago

Using private set intersection takes more bandwidth than the server simply sending you a list of hashes to match against. (Significantly more, once you're taking about testing multiple images.)

dalbasal2• 5 years ago

The common, instinctive reaction in tech circles & HN seems to be some version of "consumer action," vote-with-your-dollar stuff. This isn't going to work. It almost never does. At most, it'll be affect a minor tweak or delay.

This is a political issue, IMO. A thousand people protesting outside Apple HQ and/or stores is worth more than 100 thousand consumer striking. IMO, the main non-political avenue here is alternatives, especially FOSS alternatives. It's hard to see a way to widely adopted FOSS phones from here, but if we had a viable alternative things would look different. That's producer action, rather than consumer action.

Make it an issue in elections. Stand outside Apple stores with a sign. Push for a Digital Freedom law. Etc. An Apple labour union, maybe. The conscious consumer game is a dead end. It usually is.

judge20208• 5 years ago

The common, instinctive reaction in tech circles & HN seems to be some version of "consumer action," vote-with-your-dollar stuff. This isn't going to work. It almost never does. At most, it'll be affect a minor tweak or delay.

If "vote with your wallet" doesn't work and only causes, say, 1 million people (out of the billion+ customers) to switch off of iOS, doesn't that mean that the rest of the billion+ people really don't care enough? Maybe a few million more accept the tradeoff of getting iOS for 'scanning my photos for csam and having the ability to move off of iOS later if they expand usage or this system otherwise has issues'.

Maybe, just maybe, even if a million people complain about this and apple loses an extreme amount of iPhone sales upwards of 20 million, they can still sell 220 million[0] iPhones to people who don't care. We are certainly the vocal minority here - whether or not that warrants government intervention or otherwise harms our society doesn't really matter when Apple still makes tens of billions in profit a quarter.

0: https://www.macrumors.com/2021/04/07/2021-iphone-sales-forec...

dalbasal2• 5 years ago

>If "vote with your wallet" doesn't work and only causes, say, 1 million people (out of the billion+ customers) to switch off of iOS, doesn't that mean that the rest of the billion+ people really don't care enough?

IMO, no. This is silly logic. I don't particularly care that Apple scan my photos.

First, most people don't care about or understand any particular issue well. You might care about the freedom issue here. Another person cares about oceanic biodiversity. Another person cares about factory working conditions. All of them make purchasing decisions that affect all of these. The civilians will always outnumber activists 100-1 on any particular issue.

Second, in this particular case, choices are few and poor. Hence exasperated declarations of going back to dumb phones or DIYing something.

Third people's individual purchasing decisions don't have any effect on the thing they're trying to affect.

In any case, my point was empirical, not theoretical. There are very few significant examples of consumer action amounting to anything. Where it has (eg dolphin safe tuna), consumer action was one piece of a much bigger puzzle, and more about raising awareness than direct. IE people buying dolphin safe tuna also become insistent on regulatory action. By the same logic, you could conclude that people don't care enough about anything. In which case, we come to the same conclusion.

space_rock• 5 years ago

Using child abuse as the example crime for this crime prevention technology makes it feel like they want to silence any criticisms of their phone monitor technology

intricatedetail3• 5 years ago

What is the current flagship phone that could run e.g. Ubuntu Touch? I am looking for a new phone that will not be worse than my current driver from 2018.

axiosgunnar• 5 years ago

Let‘s play a simple game.

Go to https://www.apple.com/child-safety/pdf/CSAM_Detection_Techni...

and then replace

- "National Center for Missing and Exploited Children“ with „the new Trump administration“

- „child pornography“ with „LGBT content“

Doesn't look fun anymore, does it?

(use „the new Clinton administration“ and „images of guns“ if you are conservative)

AlexSW• 5 years ago

I'm not sure of the point you're getting at. You can do this with effectively anything. Replace "gay marriage" with "child sexual exploitation" in "I support gay marriage". Does that mean we shouldn't support anything?

indymike2• 5 years ago

Does that mean we shouldn't support anything?

Op is pointing out what a universal evil Apple's scanning of personal property at scale is.

jbuhbjlnjbn3• 5 years ago

I understand you wanted to refute the former comment, but, ironically, that is indeed the case in point: when we cannot trust that the the thing we support won't be exchanged with something else in the future we don't support, without our knowledge, then we indeed should not support it.

nullc10• 5 years ago

Somewhat offtopic, but the subject caused me to make a disappointing realization:

The most sure way for someone to obtain child porn images that won't trigger a hit in these known child-abuse-image databases would be for someone to take new photos.

Is there a reason we can be confident that these databases aren't creating a market for novel child abuse at a greater rate than they're taking abusers out of the community? Esp since presumably abusers are only a (small?) subset of people who view these images?

meowster2• 5 years ago

Or if it's just a simple hash, change a single, impercetible pixel in the photo.

judge20208• 5 years ago

See this other HN thread - https://news.ycombinator.com/item?id=28091750 - they make it a 'perceptual hash' instead of a bytestream hash since they know a lot can and will be done to try to evade PhotoDNA and NeuralHash.

judge20208• 5 years ago

The target of NCMEC's database is stopping the distribution, and hopefully encouragement of CSAM. Besides how the distribution can negatively impact the mental state of victims, distribution and more eyes on it might cause more people already on barely-legal parts of the internet (ie. qanon message boards) to learn about ways to obtain CSAM and become part of the market of buyers for such material. If you stop that, then the population of people looking for CSAM shrinks and makes it less economical for criminal enterprises to target children specifically for the production of the illegal material.

nullc10• 5 years ago

The target of NCMEC's database is stopping the distribution, and hopefully encouragement of CSAM.

But potentially with the unintended consequence of encouraging the creation of more child abuse material, in order to evade the detection of recognized images.

weikju• 5 years ago

Anybody else feel the chilling effect, wanting to sign this but unsure of future implications of doing so?

helen___keller• 5 years ago

Just a reminder that proprietary software that auto-updates does not serve you and should never have been treated as such. Sometimes it's most convenient / best to use proprietary, and that's fine, but please be aware that all vendors with root level access (google + android, microsoft + windows, etc) are just 1 update away from this situation.

WA2• 5 years ago

If it’s just a list or hashes, any possessor of CSAM could simply modify a few pixels to make it no-matching, no? How "flexible" is the matching?

And if it is flexible, what about false positives? What if I have a pictured of my naked son on my device and I get flagged? Will the picture of my son get uploaded to the cloud "for further analysis" even though I don’t have iCloud enabled and never signed up for this?

Edit: A sibling post has this link, which answers some of these questions: https://www.apple.com/child-safety/pdf/CSAM_Detection_Techni...

Grustaf5• 5 years ago

I think it makes sense to take a step back and ask yourself if Apple, or any sensible Western company, would set up a system that could falsely flag millions of people, or even a hundred. Even without going into implementation details, it seems clear that they would not have a system that would flag standard family photos.

WA2• 5 years ago

I wouldn't over-/underestimate the support capabilities of a big corp like Apple.

I remember the Twitter account takeover hack a year ago, which was possible only because customer support had some 2FA-bypass: https://en.wikipedia.org/wiki/2020_Twitter_account_hijacking

To prevent false-positives, who knows if they have a "review" team that takes a tiny little peek at my naked son. Do you know for sure that no such system is in place or ever will be in place? What if they do get hundreds of thousands of false positives in the future? How would they improve their system if not by reviewing the existing system with real data?

metta2uall2• 5 years ago

I'm not sure what the solution is.. Child abuse is an extremely severe problem. In the future encrypted-messaging may be used by terrorists developing some weapon of mass destruction like a virus. I'm concerned about privacy, but is it tenable to have true E2EE regardless of the harm? For better or worse it seems that human societies will prioritise physical safety over most things.

Even if we have true E2EE, a bad authoritarian regime in the future can simply make it illegal. It's more imperative than ever to prevent such a regime arising in the first place..

travoc• 5 years ago

The solution is for law enforcement to show evidence of a crime to get a subpoena.

If you don’t think it works, check out your local list of Megan’s Law participants.

metta2uall2• 5 years ago

Unfortunately law enforcement don't have super-human powers and very often don't know who exactly is involved..

michalu• 5 years ago

Apple's new policy will have only one effect - pedophiles will stop using ios. For the rest of us, our privacy will remain compromised.

Jolter4• 5 years ago

Pedophiles in the know would presumably just have to disable iCloud sync, and the hash scan would never happen.

seanp2k28• 5 years ago

This. It’s not like iCloud and GDrive are the only two cloud storage vendors, or like there’s no way to encrypt things before uploading them.

athrowaway3z• 5 years ago

I kind of stopped after:

fundamental privacy protections for all users of Apple products.

Users of Apple (should and largely do) accept they are not in control. Apple has always been clear this is a feature not a bug.

This is the logical next step to justify that their lock-in/monopoly has unique features beside making them more money.

Jenda_2• 5 years ago

Notice, for example, that Thunderbird is sending file names and SHA-256 hashes when you open most (e.g. .pdf) attachments, in the clear, to Google. This seems worse to me (in the Apple case, the information is revealed only if enough files from one device match against a predefined hash list) and nobody really cares...

I have just tested with a fresh profile with a freshly downloaded thunderbird-78.12.0.tar.bz2 (x64 Linux, en-US) using a Burp proxy. Here is the function that does it: https://searchfox.org/mozilla-central/source/toolkit/compone...

Here is the about:config tweak to turn it off: browser.safebrowsing.downloads.remote.url

Here is an example request: POST https://sb-ssl.google.com/safebrowsing/clientreport/download...

Content is Protobuf-encoded payload containing:

- full path to the mailbox including the username and "secret" random profile name (e.g. /home/jenda/.thunderbird/ioi8uk0k.tbtest/Mail/hrach.eu/Inbox)

- SHA-256 of the file

- attachment file name (e.g. 10-test-blahblah.pdf)

chrisrhoden2• 5 years ago

I suspect that if they were strictly bitstream hashes and not perceptual hashes, people would be less concerned.

judge20208• 5 years ago

No, i'm sure people would still make a fuss. Perceptual hashes are required to prevent criminals from slightly changing pixels within CSAM photos to avoid detection.

the8472• 5 years ago

At least mozilla lets you disable that, does apple?

alex77456• 5 years ago

after seeing recent events around mozilla, I suspect they would not allow disabling that if they could get away with it

(don't get me wrong, "everybody sucks")

Jenda_2• 5 years ago

Yes, however, there is little practical advantage in this, if nobody knows about it and so nobody turns it off.

moelf• 5 years ago

Do you produce most email attachment in your inbox yourself? Do you produce most photos on your iCloud yourself? The point is anti-virus (purposed) hash upload is different from your private iCloud content hash upload.

amelius2• 5 years ago

E-mail is an old technology which had privacy bolted on top of it as an afterthought.

Everybody knows that e-mail is not the best medium if privacy is of utmost importance.

Rd6n6• 5 years ago

I had no idea. What is the reason for this default behaviour?

hkai• 5 years ago

Expect people to be swatted by placing CP on their laptop.

Jolter4• 5 years ago

Except this doesn’t scan the contents on your laptop. It scans what you upload to iCloud.

FirstLvR• 5 years ago

Let's not forget Microsoft is doing this same fukery for years

https://www.microsoft.com/en-us/photodna

ChrisMarshallNY• 5 years ago

Wasn't this covered, yesterday? It seems to be a GitHub Pages site that links to the same resource that was posted here yesterday.

But I think it def deserves a lot of scrutiny, and I support the effort, so I'm not really complaining.

JacobiX• 5 years ago

I think that the used technology described in CSAM Detection Technical Summary (the so called NeuralHash) is a really bad idea, basically it uses the output of a neural network (likely a CNN) trained using the now classical triplet loss (see page 5). The problem with those methods that they are not always reliable, for instance the same type of networks and same training procedure is used in neural face recognition that proved to be vulnerable (A recent example is the 'Master Faces' That Can Bypass Over 40% Of Facial ID, etc).

ryeguy_242• 5 years ago

I wonder what image transformations would yield a different hash in the NeuralHash algorithm. Anyone know?

From Apple: “The neural network that generates the descriptor is trained through a self-supervised training scheme. Images are perturbed with transformations that keep them perceptually identical to the original, creating an original/perturbed pair.”

randcraw• 5 years ago

Not a pair. The number of possible perturbations of each example image in deep learning are enormous. This blithe quote implies that a hash code somehow can provide a flexible match against the billions of perturbations even a single image can undergo. It's a specious claim, and intended to cow anyone from disbelieving in the effectiveness of such a brute force match model.

ryeguy_242• 5 years ago

If you had the weights of the hashing neural network (NeuralHash) could it be reversible so that a hash could derive a similar photo to the original?

metahost• 5 years ago

Neural networks are generally assumed to be non-invertible functions. That said, something like an auto-encoder can learn to decode the encoded data back to its original form, with loss.

jacquesm• 5 years ago

Apple in the eyes of many had one redeeming feature over the competition: they appeared to value privacy. The problem is that the 'many' are still a small minority, and that the much larger contingent that Apple serves sees them more accurately for what they are: a consumer electronics manufacturer, where privacy is not an absolute concept but something malleable as long as it serves the bottom line.

The tech world seems to have a problem reconciling these two views.

JudasGoat• 5 years ago

I am relatively sure that Apple has made concessions to the Chinese government to allow it's existence in the Chinese market. I would guess that other Governments might feel slighted if not offered the same access.

intricatedetail3• 5 years ago

It seems like it is coming together. They'll be able to figure out what kind of person you are by looking at your phone's content. Then at your next vaccination, you'll get one that causes a blood clot or you'll get sterilized. It's not like government hasn't done some of those things. Now it is only going to be automated.

c7DJTLrn• 5 years ago

I'm disturbed by this ordeal and Apple don't seem to be backing down. I was thinking of getting one of the new MacBooks later this year but I think I've changed my mind - I won't buy products from a company that treats its customers as pedophiles. My phone is getting pretty old too, don't think the next one will be an iPhone.

schappim• 5 years ago

Boycotting Apple products will not make a difference. Apple doesn't care, what Apple does care about is bad PR.

Generating and sharing bad PR is the only way to get Apple to change something.

Think about the Bad PR around Butterfly Keyboards, MacPro, App Store Policies etc and Apple reversing course on decisions.

An open letter against Apple's new privacy-invasive client-side content scanning

Related Stories