Apple defeats liability for not scanning iCloud for CSAM

https://blog.ericgoldman.org/archives/2026/07/apple-defeats-liability-for-not-scanning-icloud-for-csam-but-the-judge-was-not-pleased-amy-v-apple.htm

by speckx • 1 day ago

445 506 1 day ago

blog.ericgoldman.org

jobs_throwaway• 1 day ago

A win for privacy and freedom

hosteur• 1 day ago

Indeed. And a rare one at that.

amazingamazing• 1 day ago

It is crazy people think apple isnt on the side of privacy. Are they perfect? Not even close, but compared to the rest of big tech theyre simply on another level.

Apple could easily not do this stuff and it may even be easier to not.

cryo32• 1 day ago

Indeed.

But they are until they are actually defeated. I would rather plan for failure. We are in a global climate where court rulings can be ignored.

avidiax• 1 day ago

It is crazy people think apple isnt on the side of privacy.
It also ensured pressure from governments and plaintiffs, including CSAM victims, who preferred Apple’s more interventionist approaches, which Apple had voluntarily demonstrated it was willing to do.

I feel that Apple open pandora's box with the client-side scanning. It proved that it was technically feasible, and was "privacy preserving". I use scare quotes there because I don't think that political or religious dissidents would find that the same or similar technology used to discover and persecute them is "privacy preserving". And that's really the problem with Apple here. They provided a model for scanning for any kind of message or material while purportedly maintaining privacy.

mmmlinux• 1 day ago

Is it different than telling your therapist something in confidence and then finding police waiting for you in the lobby.

bayindirh2• 1 day ago

It proved that it was technically feasible, and was "privacy preserving".

Didn't their paper disproved by reversing the perceptual hashes to reveal blurred version of the images being hashed, and Apple basically said "that's fair, it's not as robust as we wanted, let's visit this later"?

If not, I'll happily stand corrected, but please share sources.

Addenda:

- Apple's original paper: https://web.archive.org/web/20210807165030/https://www.apple...

- Paper breaking the hash: https://arxiv.org/abs/2111.06628

Edit: The second one is the wrong paper. I’ll find and link the correct one tomorrow. Keeping the link for transparency.

trollbridge2• 1 day ago

I thought the client side scanning was to protect children? If it suspects an image is bad, it blurs it and pops up a warning including a link to resources to go to for help.

Very different than trying to narc out users to the authorities.

FireBeyond2• 1 day ago

I still also totally don't get their policy.

Trying to avoid false positives by not firing until a threshold was hit (was it 20 images?) seemed insane from a PR position... rightly or wrongly, all it would take would be the wrong court case and you can see the headlines:

"Apple says users can have up to 20 CSAM images on their phone before they'll tell police"

GeekyBear5• 1 day ago

I feel that Apple open pandora's box with the client-side scanning.

That box has been open for years now.

Big brother is already watching what you do on your Android device.

A Dad Took Photos of His Naked Toddler for the Doctor. Google Flagged Him as a Criminal.

https://www.nytimes.com/2022/08/21/technology/google-surveil...

ribosometronome2• 1 day ago

The Pandora's box was already open and essentially no one noticed nor was there immense pushback that resulted in the features being removed. Photo scanning was already happening for both Android and Apple for the purpose of image search.

inigyou26• 11 hours ago

Engineers tend to be too people-pleasing. When someone from management asks "can you scan devices for CSAM without violating privacy?" the answer should not be "hmm... well... maybe if we did it this way it could work". The answer you should give us "no" or to hedge your bets "I don't think so". Same to the government and the court. In particular a court isn't asking for a statement of objective reality whether it's possible, they're asking whether you think you could do it.

LatencyKills• 1 day ago

I was an engineer at both MS and Apple. At Apple, privacy was baked into every new feature from the start. At MS, the privacy component was glued on at the very end, if ever.

Like OP said, Apple isn't perfect nor will they ever be, but they do prioritize privacy better than most.

an0malous2• 1 day ago

I said this in another thread a while ago, and one of these people who thinks Apple isn’t on the side of privacy cited a lawsuit they settled around Siri listened to conversations: https://www.scientificamerican.com/article/apple-settles-cla...

People understood this settlement to mean Apple was spying on their conversations and selling them to advertisers, when it seems to have more to do with people accidentally triggering Siri. But people don’t care about this kind of nuance or actually tallying up all the ways Apple is pro privacy against rare issues like this one. It’s all just tribalism at the end of the day.

bigyabai3• 1 day ago

This is also a misunderstanding of the case, though. The suit wasn't filed because of accidental Siri triggers, it was filed because Apple never informed users that third-party contractors would be listening to retained recordings of accidental invocations. From the original Guardian report:

Although Apple does not explicitly disclose it in its consumer-facing privacy documentation, a small proportion of Siri recordings are passed on to contractors working for the company around the world. https://www.theguardian.com/technology/2019/jul/26/apple-con...

Regardless of how you feel towards Apple, this sort of data should be siloed in a way that makes it impossible to share with undisclosed third-parties. It also should not be shared anywhere until Apple can confirm that PII and other sensitive information was redacted from the data, which they did not. It generally points to a laissez-faire attitude towards personal data that is hard to abdicate without seeing the Siri server-side code or retention architecture, which is why Apple settled to avoid revealing the extent to which they retain and share data in a class-action discovery process. The settlement is a mea-culpa without admitting to wrongdoing or proving fundamental security.

The lawsuit was entirely avoidable if Apple didn't play fast-and-loose with production databases. It'll be a black eye for anyone that points to Apple's whitepapers as an example of their commitment to security - some retention simply doesn't get documented by Apple.

fsflover2• 1 day ago

Apple is on the side of privacy, except when you want privacy from Apple:

Watchdog ponders why Apple doesn't apply its strict app tracking rules to itself (theregister.com)

161 points by Logans_Run on Feb 14, 2025 | 69 comments

https://news.ycombinator.com/item?id=43047952

Apple silently uploads your passwords and keeps them (lapcatsoftware.com)

170 points by ingve on Nov 1, 2024 | 127 comments

And whenever your privacy contradicts their control over "your" device, you are also out of luck, e.g., you can't have Ublock Origin on an iPhone. Relevant discussion: https://news.ycombinator.com/item?id=44804921

dd8601fn2• 1 day ago

It's telling that these come from people trying to implement tracking and high visibility into user behavior, and complaining that Apple won't let them even though Apple conceptually could.

Except ublock, which can't do what it does the way it normally does, for the same reason you can't have any plugin inspecting realtime activity and doing scriptlet injection.

You can have ad blocking. You can't have plugins with that kind of low level access to your browser activity.

You can prefer something that allows dangerous behavior as a trade-off for greater capabilities, but you can't deny it's a safety trade-off where Apple picked what's safer.

SXX3• 1 day ago

Apple is very much like WhatsApp. Yes you cant perfectly trust their E2EE against state actors, but both in fact put some effort into making world have little bit more privacy.

At least on Desktop we have usable Linux, but on the phones there is literally nothing usable because thanks to Google efforts switching to GrapheneOS mean tons of apps either not working or break every few months.

Yes its possible to make Andoid spy on you a little less, but even for tech savvy person its damn inconvinient and Google making platform worse with every single release.

Thanks to Google "security" I can use my banking apps on 9 years old device with 6 years outdated firmware, but not on GrapheneOS.

Cider99862• 1 day ago

Apple is very much like WhatsApp. Yes you cant perfectly trust their E2EE against state actors, but both in fact put some effort into making world have little bit more privacy.

They probably use E2EE just so they don't have to respond to court orders and such.

Pfhortune• 1 day ago

hanks to Google efforts switching to GrapheneOS mean tons of apps either not working or break every few months.

I've been using GrapheneOS for years and that hasn't been my experience. There are two financial apps that don't work for me, and that's it. Pretty much everything else I use is fine. But, to be fair, I'm very scrupulous about my apps and tend to avoid installing an app for every little thing that wants me to.

drnick15• 1 day ago

thanks to Google efforts switching to GrapheneOS mean tons of apps either not working or break every few months.

Sometimes, all you need is a Web browser. I personally don't want any "apps" on my phone that aren't basic utilities.

I am aware some banks in Europe require 2FA on a mobile device. Short of switching banks, my answer to that is a cheap or e-waste Googled Android phone that stays at home and serves that sole purpose.

anonymars• 1 day ago

WhatsApp insists on having access to your contact list. Pro-privacy, it ain't. It's still a Meta product.

amelius• 1 day ago

Apple may be on the side of privacy, but since they are competing everybody out of the market with their slick consumer products they actually form a threat to privacy since now the government has to only implement a backdoor at one vendor.

macintux• 1 day ago

I have a suspicion that Google and Android aren't going to just vanish.

goolz• 1 day ago

It is crazy that I do not trust a multi-trillion dollar company who has forced labor in their supply chain to have my best interests in mind? It is crazy to me you would think they do not understand the concept of lip service.

These companies are liars. I do not trust liars. It has served me well.

tzs3• 23 hours ago

You mean the company that does hundreds of assessments per year of companies all throughout the supply chain, including surprise spot checks, and forces those it catches violating labor standards to fix the problem and also provide remedies to the affected workers?

Quite a lot of the labor issues in Apple's supply chain we found out because Apple found them and included them in their annual report on these and other supply chain issues.

mikenew• 1 day ago

Apple is on the side of privacy if it serves their marketing. Which is why they would rather build and normalize CLIENT SIDE CONTENT SCANNING so they can continue to market iCloud as "secure and private".

If Apple's interests sometimes align with ours then great. I'll take it. But don't attribute to this ~5 trillion dollar company some kind of altruism.

nozzlegear4• 22 hours ago

If Apple's interests sometimes align with ours then great.

Altruism or not, I've found that their interests almost always align with mine when it comes to privacy.

Isamu• 1 day ago

Privacy is a natural fit for Apple in that they make money on discrete devices, but services have grown tremendously. That’s where the erosion of privacy happens.

So once there’s a profit motive for violating your privacy, the justification for eroding your privacy will proceed. It’s really the inertia of Apple starting out as privacy-compatible that makes them hesitant to throw that away.

drnick15• 1 day ago

It is crazy people think apple isnt on the side of privacy.

Apple is on the side of making money, and the privacy claims are mostly marketing. The entire stack is closed source, which means it is difficult and expensive to independently verify any of the claims made. What's more, the "auto update" universal backdoor means that Apple can forcibly push a user-hostile "feature" like client-side scanning when it wants or is compelled to by a state actor.

Razengan2• 1 day ago

It is crazy people think apple isnt on the side of privacy.

Look up the "iCloud Keychain" API:

For years Apple has let and helped Facebook, TikTok, Tinder etc. track users even after you delete an app, even ACROSS DEVICES and DEVICE RESETS.

There's no way to even SEE what data the apps have stored on your device & iCloud account on iOS, only through the macOS Keychain Access app. Even then you can't be sure that that's all that being stored.

They temporarily changed course and wiped iCloud Keychain data when deleting apps, but only during a single beta of iOS some years ago, and then reverted to the way it is now.

This scores so many points in favor of privacy intruding corporations that it puts Apple far from being the paragon of privacy they pretend to parade as.

nozzlegear4• 22 hours ago

It's misleading to claim that Apple has "let and helped Facebook, TikTok, Tinder etc. track users [...]" using the keychain API. The persistence you're talking about, which those companies exploit, is a side effect of how the API works, not an intentional surveillance feature. Furthermore, it's not some special API that those big companies made a deal with Apple to get access to – any iOS dev can use it.

It's a real flaw that they should've fixed a long time ago, but your conspiratorial framing makes it seem like Apple colluded with Facebook et al. to end run their own privacy protections, while ignoring the fact that Apple's App Tracking Transparency feature has cost Facebook billions.

daveisfera• 1 day ago

I agree but sadly that's eroding. They're starting to let advertisers into the walled garden and it's becoming too big for them to ignore it. That will only get worse and then one day Uncle Sam will walk in with a big check and things will change.

Sephr• 1 day ago

Apple has degraded privacy online through Safari's cookie-preferential storage partitioning (i.e. site capabilities are penalized for using private localStorage instead of cookies), requiring sites to occasionally leak data over the network for multi-subdomain same-site web applications. These applications can privately share local state offline in Firefox and Chrome but usually serve the lowest common denominator, so many webapps use cookies to support Safari.

They're pro-privacy when it serves them financially.

kevin_thibedeau• 22 hours ago

They aren't. They're on the side of making money and using backroom deals with the DOJ to avoid antitrust regulation. This is how a broken image hashing tool was surreptitiously installed on every iPhone.

tjoff• 12 hours ago

To me it is crazy people go out of their way to defend apple in this area.

They might be slightly better than some others (horray!) but given their ecosystem it is still the worst platform if you value any form of freedom. Depending on apple for your privacy is ignorance at best.

selicos• 4 hours ago

Their level is set where it best feeds their revenue. Their security plays equally as well into their walled garden.

i3ima• 1 day ago

the judge is indeed wise

JSR_FDED• 1 day ago

The judge called the outcome disturbing, as it leaves victimized children as "collateral damage" of privacy protections.

As sad as this is, end to end encryption means no CSAM scanning.

As an alternative Apple previously tried to do scanning on the phones locally but caught hell for that too.

This is one of those unfortunate tradeoffs but I see no alternative to privacy taking priority.

al_borland2• 1 day ago

Children are often used as a weapon to erode freedoms, like privacy and speech. Those pushing it rarely actually care about the children.

layer83• 1 day ago

While I’m decidedly pro-encryption, I don’t like this argument. If something is the right thing, it would still be the right thing when promoted for the wrong reasons, and if it’s the wrong thing, it’s still the wrong thing even when at present nobody has ulterior motives.

When arguing against surveillance, the arguments should be on its merits, not on whether the current proponents happen to have ulterior motives.

owisd• 1 day ago

Feels like this has gone completely meta and it's now way more common to see people who don't care about children refusing to support that any proposal that might benefit children under the assumption that nobody cares about children so there must be an ulterior motive.

majorchord7• 1 day ago

As sad as this is, end to end encryption means no CSAM scanning.

I think it depends on your definition of e2ee and where the "end"s are.

If the locally running application can decrypt the data, it could always do whatever it wanted. Is that really how you define e2ee?

cortesoft2• 1 day ago

The locally running application is one of the 'ends' of the end to end encryption.

megous2• 1 day ago

I wonder if the judge would be in favor of companies proactively going into people's houses at random to check on their belongings, if they don't have inappropriate photos somewhere, or whatever.

It's harder to do, but conceptually the same. So sad it's not being done. Very disturbing.

They could do it when people are not at home. There'd no problem, nobody would even notice.

slashdave8• 1 day ago

Kind of a bad analogy (not service related, no associated liability).

A better one: what about rental property, like a business? Can the landlord randomly check for criminal behavior?

an0malous2• 1 day ago

semiquaver• 1 day ago

The judge’s dicta about protecting children in her pro-privacy ruling upholding existing law “tips their hand” that they are somehow part of a global conspiracy to eliminate privacy?

I think your conspiracy theory needs work, to be perfectly honest with you.

0cf8612b2e1e2• 1 day ago

People can also distribute heinous things through snail mail, but we are not yet at the point where the government reads all letters looking for wrongthink.

Just because we technically can make a privacy destroying drag net does not mean we should. Had phones existed 250 years ago, I have no doubt the founders would have thought it obvious that a cellphone’s contents were your personal papers which could not be freely searched.

ajsnigrutin2• 1 day ago

More effort should be done to find real-world equivalents of such actions and "think of the children".

An icloud is like a storage locker or a safety deposit box... the owner should go through all your stuff there, just in case you have some CSAM!

Metadata is just tracking info about who, where and with whom... every bartender should take your IDs and log when you came to the bar, who you sat with and how long you talked there.

EU Chat control is like general eavesdropping... every time you sit down and talk with someone, an EU bureaucrat should sit next to you and listen and write down your conversations, just in case.

etc.

Somehow people think that "it's ok if it's on the internet", even when it's stuff they'd never accept in real life.

timcambrant• 1 day ago

But that's mostly because it's impractical. They do use dogs to sniff for drugs and explosives, so if CSAM smelled or was visible through X-ray then it would probably be a different story. And let's not forget snail mail is by far a more uncommon way to spread that material than the Internet is. The Internet came into broad use just ~15 years after commercial CSAM was openly being sold by mail order in Europe.

Personally, I am on the side of privacy, just to be clear.

izacus6• 1 day ago

Police can absolutely open snail mail with an appropriate warrant when investigating traffickers.

slashdave8• 1 day ago

end to end encryption means no CSAM scanning

Not true. There is the option of scanning on the device.

yason• 1 day ago

Owning your device (instead of the manufacturer, a set of unlisted governments, big software corporations, etc.) means no scanning.

EmbarrassedHelp4• 1 day ago

Circumventing encryption with client side scanning is on par with requiring encryption backdoors, and goes against the purpose of having end to end encryption.

SepiaSapient4• 1 day ago

Truly being honest, I think CSAM scanning of private comms is ineffective in the long term anyways. Pedophiles aren't stupid, you'll drag a bunch at first but the networks will be reestablished and sharing will be done via sneakernet.

The primary focus should always in preventing the creation of CSAM.

- Comprehensive Sex Ed starting young so kids can identify grooming and seek help from a trusted adult, even if abuse comes from a family member.

- Fixing schools in general so homeschooling isn't as attractive for parents. Keep a tab on home schooled children and identify social isolation.

- Bigger resources for actual honest to god on the ground investigations.

To be clear I'm not saying that homeschooling = child abuse, simply there's a lack of the mechanisms to detect it in homeschooling settings.

Zak3• 1 day ago

Pedophiles aren't stupid

I'm not entirely convinced that's true. Facebook is a leading reporter of CSAM, much of it sent through Messenger, which only recently got E2EE, and Instagram DM, which briefly had E2EE but no longer does. If I was going to transmit something that could get me in trouble, it certainly wouldn't be via Instagram DM.

Facebook's EU CSAM report is here: https://transparency.meta.com/reports/regulatory-transparenc...

EmbarrassedHelp4• 1 day ago

The judge's comments are extremely disturbing, as she seems to want legislation passed that requires companies to violate user privacy.

And client side scanning is just as bad as encryption backdoors. There's a good reason Apple was attacked for even considering it: https://arxiv.org/abs/2110.07450

twuopf• 1 day ago

I know creating a throwaway to hide your name for an opinion is a bad manner, but this one is one I really don’t want linked back to me

The VAST majority of “CSAM” is consensually created and exchanged by teens. Their future selves and their parents form this pressure group attacking everyone’s liberty and privacy to try to undo the downsides of choices they made themselves with full knowledge of what could happen.

The criminal and disgusting tail end of this type of material deserves the worst of consequences for the perpetrators and all the support in the world for the victims, but these are mostly - you guessed it - poor and unprivileged children from far away places and they certainly can’t put this much pressure on apple

alistairSH2• 1 day ago

Do you have a citation for that? Sounds plausible, but I'm not sure I've ever seen it stated that way in any of the related media reports on CSAM efforts.

mschuster912• 1 day ago

In Germany, the rise in "youth porn" material has been attributed to such kinds of cases where youth send intimate pictures to each other [1].

Our legal systems are not built to deal with that mess, and it may hang around your neck for the rest of your life. Unfortunately, the law is very explicit, leaving barely any avenue for the courts to drag us out of the mess, and politicians - even if they are actually interested in the topic in the first place - won't touch that area with a ten foot pole for fear of getting blamed a pedophile themselves.

[1] https://www.n-tv.de/panorama/KI-treibt-Jugendporno-Fallzahle...

aljgz3• 1 day ago

Are there statistics backing up the "VAST" majority claim?

While on statistics, I wonder, are there reliable statistics about child abuse of different types? Studying correlations with other social metrics, like sex education, liberal/conservative, policies regarding prostitution, and others can provide support for/against decisions.

Not that I hope these will impact people's and governments' choices, but I want to challenge my intuitions.

mrkeen• 1 day ago

That's the fun of it. Try to find out? Straight to prison.

IshKebab6• 1 day ago

It's probably impossible to get reliable statistics about that given how both groups are trying to keep everything secret. But you can consider how many paedophiles there are vs how many horny teenagers there are. Based on that it would be extremely surprising if he was wrong.

The real question is what happens when a horny teenager sends another a nude. There definitely have been insane cases where they get stitched up for creating child porn. I don't know if that's the normal outcome today though.

majorchord7• 1 day ago

Children cannot legally consent to most things in most places, especially until near the end of their teen years.

pixel_popping2• 1 day ago

They can't consent but it does make sense that it's true, I would genuinely bet that more nudes are being shared between 17-year olds than some freak, as this is common to the point where I feel a very large portion of all existing teens have done it.

kstrauser2• 1 day ago

I think you’re right, but from another angle. In the state where I lived way back when, a state representative put forth a bill to explicitly make e-CSAM illegal. I guess it was already illegal for print media and this covered a gap in the law about cell phone pics, etc. Thing is, it had no allowance for the age of the picture taker, or even whether the picture taker was the photo subject. If a 16 year old girl took a nude selfie and sent it to her boyfriend, she was a felon.

I wrote to the rep and explained my concerns. I wholeheartedly agreed with the intent of the law, but the code was buggy. To my surprise, he wrote back in horror to say he hadn’t considered that and pulled the bill immediately. I’m proud of having done that.

I’m 100% pro yeeting child pornographers into the sun. I still don’t want to throw kids in prison or remove all traces of a right to privacy in our haste to sun-yeet them.

fortran773• 1 day ago

I still don’t want to throw kids in prison or remove all traces of a right to privacy in our haste to sun-yeet them.

The one messy corner of this is the "strict liability" for this type of material. An underage kid can take a nude photo, send it to an adult, and then the adult can criminally liable for just having it, even if he deleted it as soon as he saw it. Either both parties involved in handing something for which there is "strict liability' need to be held accountable, or "strict liability" has to be changed so a person isn't liable if he deletes or reports the material as soon as he first becomes aware of it. And this isn't likely to happen because it would provide a plausible defense for every one criminally charged.

r3trohack3r• 22 hours ago

To my surprise, he wrote back in horror to say he hadn’t considered that and pulled the bill immediately. I’m proud of having done that.

Stories like this give me hope - thank you for sharing

egorfine2• 11 hours ago

pulled the bill immediately

This is weird indeed. These bills are mostly put forward in order to appear tough on crime and secure votes of the naive population ("think of the children"). Pulling the bill is detrimental as it may lead to "pedo supporter" conspiracy spreading among the district.

Aurornis• 1 day ago

The proposed CSAM scanning used perceptual hashing to try to identify CSAM material known to law enforcement.

It was not a tool to identify private images as being underage. That’s an impossible task.

trollbridge2• 1 day ago

I'd say modern AI tools could probably do this pretty effectively. They're very effective at describing anything else about an image. I have a workflow that churns through large amounts of images, describes them, and then looks for things I specifically want (in my case, auction listings that are not described accurately on the auction website).

cortesoft2• 1 day ago

It's impossible to do with perfect accuracy, but that doesn't mean it isn't done.

Just ask the dad who was investigated for taking pictures of his toddler for the doctor: https://www.koffellaw.com/blog/google-ai-technology-flags-da...

dfxm12• 1 day ago

I won't pretend to be so knowledgeable about how so much CSAM is being created, but keep in mind, there are laws against distribution & mere possession, too. Revenge porn is an obvious thing to be mindful of in this context in addition to other types of distribution. Consent to create doesn't imply consent to distribute (probably even to cloud storage) & is completely immaterial to issues of possession if it ends up in some 3rd party's hands. So the scope goes way wider than you're letting on. If you're saying all of these these laws are being abused, like they exist primarily to punish a state senator's daughter's ex-boyfriend, I would ask for something to back that up.

Yes, poor and unprivileged children can't really defend themselves here, but this is the system working to find some legal mechanism to do what it can, as a more powerful force. Protecting people from exploitation is a good use of government. If this was shot down for legal reasons, OK, the system is working and I hope there is a way to expand protections that fits into our system.

kccqzy• 1 day ago

I completely agree with you, but I do think that these teens do not have good opsec around these photos. It’s like the revenge porn problem but way worse. A teenager sending a nude selfie to a friend who then later shared these images non-consensually is a much bigger problem than if the same thing happened to adults.

I don’t have any ideas for a solution, but I suspect that the heightened focus on CSAM is really compensating for the fact that we don’t have solutions for revenge porn.

__turbobrew__• 1 day ago

There is no good solution to revenge porn. It is impossible to enforce that only a single person has access to an image (physical or digital), and that the person doesn’t redistribute the image.

The only way I can see this working is that people in explicit images need to publicly declare their intent for who can see the images (maybe a hash of the image content and the name of the person who can see that content) and then when the courts prosecute revenge porn the intent can be referenced to see if it was meant to be shared or not. There are still issues in that there is no proof that the person being accused of revenge porn actually distributed the images vs the defendant actually sending the images to other, or the image was leaked by a hack.

I think the best thing we can do is try and educate teens on the dangers of revenge porn like we do on the consequences of having sex. We cannot stop teens from having sex or taking nudes, but we can at least try to educate them as best we can.

abayedris• 23 hours ago

Just by casually glancing at KMP or VoL, you'd find that even the darknet pedo community itself strongly vilifies actual child abuse (known as "hurtcore"). There's truly no place for people who rape children. They are scum of the earth even in the eyes of the scum of the earth itself.

rationalist14• 22 hours ago

KMP or VoL

I'm aftaid of putting those terms in my search engine, can you please expand those acronyms?

m3kw9• 1 day ago

If these judges are so righteous, they should go further and mandate the OS to do mandatory scanning of personal hd.

dilap• 1 day ago

Don't worry, we'll get there soon enough.

stronglikedan• 1 day ago

It's still a shade of gray to me. If I offered some homegrown cloud storage to my friends, and one of them uploaded CSAM to it, you can bet your ass that I would be arrested for it.

polski-g• 1 day ago

Does Sundar get arrested if someone uploaded CSAM to GDrive?

majorchord7• 1 day ago

IMO "end-to-end encryption" simply isn't possible when the application is run by the same company as the servers the data sits on, is closed source, and can at any time, see the decrypted contents of data it downloads from their servers and do whatever they want with it.

Same issue with Proton, MEGA, and any other e2ee app... it's only useful when the company decides not to mess with the data it could always decrypt locally. Also why people are hesitant to use javascript-based e2ee solutions where the site owner can modify the code at will to do what they want.

megous2• 1 day ago

There's no issue with mega. There are third party apps and as long as you don't login to mega.nz with their website you're fine. And they also have SDK you can use that they'll not be able to control/manipulate without your knowledge.

kyralis3• 1 day ago

This is based on a faulty understanding of the underlying systems. The risk with this sort of E2E encryption is not that the service provider pinky promises not to decrypt what they have, it's that they promise they will not insert a new key into your circle of trust to subsequently start decrypting things.

IshKebab6• 1 day ago

I think you've imagined this faulty understanding. There are many mechanisms by which Apple could actually decrypt the data despite pinky promises not to. You listed one. There are others.

slashdave8• 1 day ago

Only if the company misleads and adds a backdoor to the front-end app (thus this entire discussion).

If the company is misleading, any encryption technology is irrelevant anyway.

IshKebab6• 1 day ago

Yes that's exactly his point. E2E is often sold as preventing the owners of the server from being able to read the messages at all, even if they are evil and misleading you.

That's obviously only the case if they aren't also the sole providers of the "ends".

dd8601fn2• 1 day ago

The company can provide secure enclave and allow the architecture to be audited by third parties.

Which apple does.

It's largely academic though, as almost nobody opts-in to escalated e2e posture in apple services unless they're a high risk person (journalist, dissident, etc).

The headaches that come from e2e everything are too great for most people.

majorchord7• 23 hours ago

In the US at least, companies can and do receive secret demands from the government to add whatever kind of backdoor they want, and you're not allowed to disclose it in any way, they even order you to preserve any warrant canaries you have implemented.

This is for example why Lavabit chose to go out of business instead of giving up their keys.

SepiaSapient4• 1 day ago

Beyond the privacy marketing angle, e2e allows companies with global exposure to sidestep any unpleasantness when they get a subpoena from Bumfuck, Nowhere.

Sure, the NSA, GCHQ and Mossad have a way to exfiltrate the unencrypted data but proprietary e2e is a good thing for most people IMO. Shifts the risk from "my messages are theoretically available to most law enforcement in the globe" to "YOU’RE STILL GONNA BE MOSSAD’ED UPON"[0]. This is specially good for me because I know the equivalent to the FBI where is live is too cheap to buy a Cellebrite [1] license.

[0] https://www.usenix.org/system/files/1401_08-12_mickens.pdf [1] https://arstechnica.com/gadgets/2025/10/leaker-reveals-which...

EDIT: I suppose someone could ask about Meta. The reason behind their support for scanning (and removing e2e in facebook msg) is simply regulatory capture. The zucc wishes to have a letter of marque to "protect" your children and remove the "unsafe" competitors.

EDIT2: Used the wrong term, I mixed up exfiltration channel with sidechannel attack.

johnsmith18406• 1 day ago

Side channel is academic at best.

Watching memory changing on a complex code base without having said code base is near impossible.

1. Run code 2. Watch memory changes 3. Correlate those to real data

If your code is doing anything complicated that's an intense thing to determine. If you're deep enough for a side channel there's likely a lot easier way of getting in.

majorchord7• 19 hours ago

sidestep any unpleasantness when they get a subpoena

I'm curious as to how well (legally) this "we could modify the app to do it, but nah" approach actually works, and for how long.

scosman• 1 day ago

IMO "end-to-end encryption" simply isn't possible

In a technical sense it's absolutely possible. Owning the servers != transferring keys to the servers. Most E2E apps run both client and servers, it's about if they ever had key access.

majorchord7• 23 hours ago

Right... it's one thing to for example, use a third-party MEGA client to upload files so that there's no chance of the company ever being able to see your key (unlike random javascript they might inject into the web version).

But when Apple etc. control both ends, their app could always see your data locally because it is the one that encrypts it to upload to the server in the first place. And these companies can receive secret orders from the US government to add backdoors into the local app and there's nothing you can do or say about it, except go out of business (like Lavabit).

St0n3d• 1 day ago

“Apple created its own proprietary alternative, NeuralHash, which apparently wasn’t as good. So Apple U-turned on its efforts to scan for CSAM in its cloud storage. Instead, Apple implemented end-to-end encryption for iCloud files.”

Wasn’t Apple’s design to explicitly NOT scan in its cloud storage, but look at the file on-device at the moment you wish to upload it to iCloud? This method would make it compatible with Advanced Data Protection; so ADP could have always been in the pipeline rather than Apple u-turning. In fact, NeuralHash may have been proposed because Apple wanted to introduce ADP and saw a potential problem here/get concerns from government agencies about it and saw this as a means to an end(-to-end).

The system was designed pretty elegantly and offers far better privacy protections - including guardrails - than what Microsoft and Google do, but the communication from Apple about it was absolutely horrible and generated enormous backlash. (Not saying I agreed with implementing it, just saying the design was infinitely better than competitors.)

kyralis3• 1 day ago

Also, Apple's E2E iCloud encryption vastly predated the NeuralHash efforts.

EmbarrassedHelp4• 1 day ago

A mandatory client side scanning system with an opaque database filled with unverifiable entries would render many of the protections provided by ADP meaningless. Its was insane that Apple was even considering such an idea in the first place.

drnick15• 1 day ago

I simply don't trust services such as iCloud. The legal landscape is too volatile, and Apple's own "terms and conditions" are also subject to constant change. As far as I can tell, most people don't need cloud backups, and iCloud mostly shows up as an annoyance designed to extract more money from customers. In fact, most people probably don't know that Apple and Google vacuum up their files the moment they are created, for their own good, of course.

slashdave8• 1 day ago

most people don't need cloud backups

What world do you live in?

drnick15• 1 day ago

The world where the operating system on my phone (GrapheneOS) isn't conspiring against me or uploading my files to someone else's computer.

yoz-y• 1 day ago

Everybody needs cloud backups for their photos at least.

Most people don’t have computers, those who do, do not regularly backup their photos on them.

In both family and extended family many a cry would be avoided if people paid the 5 bucks it costs to backup their photos before your phone gets stolen or lost.

poolnoodle• 1 day ago

I gotta say handling my ever growing photo collection is a pain in the ass but I'm just not okay with uploading it to some server I don't control.

djoldman4• 1 day ago

I am not a lawyer.

There is something ironic about US laws that attempt to prevent crime A by outlawing action B. For example:

  * A: physical sexual abuse of children. B: possession or distribution of CSAM
  * A: drug trafficking or tax evasion. B: structured cash withdrawals

The irony is that the more B is prevented, the less A can be detected and the less B can be used as evidence of A.

It's my understanding that conviction of CSAM-related crimes do not require any physical act to have ever occurred to any real person: one can be convicted of CSAM-related crimes related to paintings/drawings/created_art of fictional people.

It's my understanding that one can be convicted of structured withdrawals that are not driven by, linked to, or in any way related to anything nefarious.

joshred• 1 day ago

I don't think these are the same. Outlawing CSAM gives law enforcement the ability to shutdown markets and prevent commercial distribution of CSAM. Sexually abusing children is heinous, but sexually abusing children for financial gain is even worse.

carljungslabtek• 1 day ago

There are even people involved in commercial distribution of it that claim to not even be interested in children, just in profit or even allegedly “for a sense of community” (someone actually said this after getting caught, he was in his 20s but I can’t remember his name — he might have been one of the red room guys).

On top of that, while there are different types of child abusers, the worst ones almost invariantly collect CSAM to the point of hoarding. So it really isn’t that bad of a proxy.

The root comment is implying that legalizing or decriminalizing csam would somehow help with prosecution of child abuse? I’m kind of speechless. Csam IS child abuse. The fact that there are consumers encourages producers to, well, produce!

IncreasePosts3• 1 day ago

There's also the argument that CSAM can act as a gateway leading people from just being a pedophile in their head, to going out and doing something to some child.

goalieca• 1 day ago

Our society is pretty aligned that distribution is another kind of harm. Non-consented distribution of sexual images (eg: revenge porn) is also a crime. Children don’t need to be the ones to press charges in child porn unlike with adults. That’s a good thing.

ux2664782• 1 day ago

Our society is pretty aligned that distribution is another kind of harm.

As well as possession. I don't actually know if those are different for CSAM, but I would assume so because they are for drugs.

cataphract2• 1 day ago

It surely is, but that doesn't change the fact that many cases are not about distribution and the harm is frequently more of a legal fiction, unless by harm you mean something other than suffering inflicted on the victims. I don't necessarily think it's wrong for society to ban certain acts on purely moral grounds (another example: incest between siblings), but let's not pretend it's something else going on.

Non-consented distribution of sexual images (eg: revenge porn) is also a crime.

There is very compelling empirical evidence that this causes actual harm (suicide ideation in a very big fraction of the victims), even if it is fictional, so here there is no question about the harm.

ux2664782• 1 day ago

one can be convicted of CSAM-related crimes related to paintings/drawings/created_art of fictional people.

This isn't necessarily the case in the US, though I believe only for drawings. AI-generated CSAM probably wouldn't fly in a court of law.

Regardless, it's a naive conception of a system of law to think of it as a utilitarian system of restitution in contexts of "this individual harmed this individual". In fact, that would fall under the category of a "tort" rather than a "crime". The law is just as much about enforcing social mores and norms as it is about dealing with individuals harming each other. Hence why locales like Canada outlaw all forms CSAM, even fictional ones. The victim taken is to be society itself. The possession of this material, implicitly entailing enjoyment of it, is so gross a violation of society's norms and mores that it becomes elevated to a legal matter.

voxic112• 1 day ago

For drawings it has to additionally be "obscene" (since obscenity isn't protected by the first amendment). And there is also a specific law that criminalizes even non-obscene realistic computer generated imagery.

engeljohnb2• 1 day ago

The law is just as much about enforcing social mores and norms

This shouldn't be the case in a society that supposedly values liberty.

pushcx• 1 day ago

No. In short, in US law, CSAM is a visual depiction of a real-world act of child sexual abuse. Visual depictions like you're describing are covered under a different law, and I'm not aware of it having a short name. There's a good expert thread on this with links to the relevant federal laws here: https://bsky.app/profile/rahaeli.bsky.social/post/3lbt7zkvlq...

djoldman4• 1 day ago

Currently it is explicitly against the law[0]:

  (a)In General.—Any person who, in a circumstance described in subsection (d), knowingly produces, distributes, receives, or possesses with intent to distribute, a visual depiction of any kind, including a drawing, cartoon, sculpture, or painting, that—
    (1)
      (A)depicts a minor engaging in sexually explicit conduct; and
      (B)is obscene; or ...
  (b)...
  (c)Nonrequired Element of Offense.—
  It is not a required element of any offense under this section that the minor depicted actually exist.

It is not a required element of any offense under this section that the minor depicted actually exist.

[0]https://www.law.cornell.edu/uscode/text/18/1466A

Manuel_D3• 1 day ago

At least in the US, fictional content is legal even if it depicts minors sexually: https://en.wikipedia.org/wiki/Ashcroft_v._Free_Speech_Coalit...

There have been a handful of convictions based on fictional content, but usually the defendants also possessed real CSAM so there wasn't much point in contesting the charges over fictional images.

arijun2• 1 day ago

Clicking on a page linked in your article, the PROTECT Act of 2003[1] (passed a year later), I see:

The PROTECT Act includes prohibitions against obscene illustrations depicting child pornography, including computer-generated illustrations, also known as virtual child pornography. Previous provisions outlawing virtual child pornography... had been ruled unconstitutional... The PROTECT ACT attached an obscenity requirement under the Miller test or the variant test noted above to overcome this limitation.

Which, if I'm reading it right, means that GP was correct in saying "conviction of CSAM-related crimes do not require any physical act to have ever occurred to any real person"

[1] https://en.wikipedia.org/wiki/PROTECT_Act_of_2003

kimjune01• 1 day ago

a 17 year old can take a nude selfie and be charged as an adult in possession of CSAM

mannanj3• 1 day ago

A: cyber crimes or other digital crimes. probably applies to many of the other crimes you mentioned too. B: privacy

mannanj3• 1 day ago

CSAM (“see-sam”) refers to any visual content—photos, videos, livestreams, or AI-generated images—that shows a child being sexually abused or exploited. Child sexual abuse material (CSAM) is not “child pornography.” It’s evidence of child sexual abuse [1]

I can't wrap my head around how AI-generated imagery is evidence of child sexual abuse (CAS). How are you abusing a real child by generating an image of a fake one?

[1] https://rainn.org/get-the-facts-about-csam-child-sexual-abus...

ipython• 1 day ago

what about an AI generated image using the real face of a minor? That can (I would argue will) cause real damage to the real child.

kmeisthax2• 1 day ago

I don't think there's a particular connection between indirect enforcement mechanisms and inability to detect the crime, though:

- Structured transactions are illegal because we put a minimum on the amount of cash that has to move before government financial surveillance applies. The alternative (at least, one acceptable to the state) would be that the government knows every transaction you make[0] no matter the size. Since we don't want that, it has to be illegal to lie about the size of a transaction. Furthermore, the harder it is to get away with structuring your transactions, the more legible the financial system becomes and the easier it is to catch drug dealers.

- Pedophiles have not stopped possessing or distributing CSAM to reduce their legal liability. Actually, this argument ignores the main reason why pedophiles store and trade CSAM around in the first place: it's specifically to scare victims into silence and revictimize those who tell the cops. In fact, this is why we stopped calling it "child porn" and started calling it "child sexual abuse material" - because it is specifically material designed to sexually abuse children by way of it's mere existence.

If you're a "no touch" pedophile (they do exist!) that's still trading real CSAM around, well... Congratulations, Nobuhiro Watsuki, award-winning author of the hit samurai manga Rurouni Kenshin, you're still doing the dirty work for the full-contact pedo who recorded the damned thing.

As for drawn child porn, involving fictional characters (i.e. not CSAM), it is legal in certain jurisdictions. Notably, America, where the 1st Amendment errs on the side of creative expression[1]; and Japan, the thinking man's Epstein Island, where... I actually don't know why the fuck Japan is so weirdly tolerant of all this sick lolicon trash. Hell, Watsuki didn't even get cancelled when it came out he had 100 DVDs worth of actual CSAM.

There's an additional layer to this, though, in that for all the crimes you brought up, there's been a history of active state complicity in the crime:

- The CIA is a drug trafficking gang that happens to moonlight as a government intelligence agency

- A good chunk of elected officials and heads of state in multiple countries were compromised by notorious child trafficker Jeffrey Epstein

- The government doesn't pay taxes. I mean, obviously, they're the ones levying them.

We like to think of law enforcement as a cat-and-mouse game: criminals do a thing and law enforcement tries to hunt them down within the bounds of 4A/5A. The reality is more complicated. There are cases in which governments actively collaborate with organized crime, either because the government is corrupt as sin, or because the criminals are offering the state a way out.

[0] Fun fact: if you use Bitcoin, you're automatically opting into this.

[1] To be clear, while I agree with the American argument, you still shouldn't actually expose yourself to this kind of porn, because you're training yourself to get horny around kids. I shouldn't have to say this, but just because it's not illegal doesn't mean it's safe to use.

djoldman4• 1 day ago

As for drawn child porn, involving fictional characters (i.e. not CSAM), it is legal in certain jurisdictions. Notably, America, where the 1st Amendment errs on the side of creative expression

As I noted in another comment:

Currently this is explicitly against the law[0]:

  (a)In General.—Any person who, in a circumstance described in subsection (d), knowingly produces, distributes, receives, or possesses with intent to distribute, a visual depiction of any kind, including a drawing, cartoon, sculpture, or painting, that—
    (1)
      (A)depicts a minor engaging in sexually explicit conduct; and
      (B)is obscene; or ...
  (b)...
  (c)Nonrequired Element of Offense.—
  It is not a required element of any offense under this section that the minor depicted actually exist.

It is not a required element of any offense under this section that the minor depicted actually exist.

[0]https://www.law.cornell.edu/uscode/text/18/1466A

laughing_man• 1 day ago

It's even worse than that. If you make withdrawals with the intent of evading currency reporting requirements you've committed a crime even if the withdrawals don't constitute structuring.

Also, in regard to the fictional CSAM depictions that stuff is still wending its way through the courts.

wbl• 1 day ago

IANAL but I thought the whole reason scanning worked was it wasn't required so there weren't fourth amendment issues.

quaddoggy• 1 day ago

Ah, the CSAM saga. Very poorly handled by Apple. Suspect it may have taken Hair Force One off the shortlist of CEO succession.

economistbob• 1 day ago

Seems like the kids miss their chance at justice because of section 230 allowing platforms the freedom to remove whatever they want but not be responsible for what they keep or amplify. That is the problem with 230. Censorship is permitted and punishing the censor isn't. Twitter and Tiktok are literally microblog platforms that get away with removing good stuff and leaving evil because they "are not a publisher" while the algorithm literally publishes a chosen set of articles to people. Facebook can remove religious freedom material and leave human trafficking groups. Section 230 gives the publishers the cake and the edict too.

junon• 1 day ago

You're conflating "what's illegal" with "what a private entity doesn't want". I don't like it any more than you do, but the first is very clear, the second is a bit harder to "solve".

inigyou26• 11 hours ago

Section 230 doesn't provide as much immunity as people think. A platform can still be liable for the choice to amplify something.

ryanisnan• 1 day ago

As the creator of mediaden.ca[1] I’ve thought about this. Client side scanning is maybe marginally better than server side scanning, but both paths lead to privacy rot.

Governments need to catch criminals, but they shouldn’t do it at everyone else’s expense.

1. https://mediaden.ca

kmeisthax2• 1 day ago

sigh

Once again, someone (in this case, the judge of this case) asks if we can meet in the middle on whether or not private communications are actually private.

To be clear: this is not a limitation of nerds' imagination. This is a limitation of physics. A person is either party to a communication (and thus can decrypt it) or is not (and thus cannot). If you demand Apple scan encrypted photos for CSAM, what you are demanding is that Apple be party to every communication done with an iPhone. There is no middle ground on encryption, there will never be a middle ground on encryption, and I will hold this truth on my deathbed.

There is no "encrypted but crackable" - if the CIA can crack it at all, we're only a few years away from some kid's gaming rig doing the same thing. There is no "secure golden key" - if there was, you could buy it in the same section of Amazon that sells copies of the TSA master key that opens all luggage locks.

Personally, the next time a government demands decryption keys, I think Apple should just set all iCloud photo libraries in that country to public and say "Sorry, your politicians made private photos illegal, take it up with them". Obviously, telegraph this far in advance and give users time to actually delete their cloud-hosted photos first. But definitely do not pretend like you can keep a secret with a government bureaucracy of hundreds of thousands of people.

But then again, Apple also capitulated (good meaning) to the EU on third-party app distribution, so Apple has a lot less of a spine than they let on. At least Google actually stayed out of China.

giantg211• 1 day ago

Maybe my perception is off, but it seems like there's a huge push by the legislature and some people to do anything and everything to prevent CSAM, yet almost nothing seems to be done to prevent CSA.

For CSAM, there's all sorts of monitoring, scanning, identify capturing, etc. But it's all after abuse has taken place, and it seems that many of the people actually arrested are arrested for CSAM and not CSA. This has even extended to fictional CSAM such as AI generated stories and pictures. As an aside, if that gets extended to political speech or other non-CSAM materials that are determined to be undesirable, that's a big concern. I can imagine that a conservative state could pass a law banning all porn because they claim it could encourage illegal activities such as prostitution, rape, or CSA.

On the CSA side, you rarely hear about arrests (they happen but less than CSAM). There doesn't seem to be any real push for educating and protecting kids before it happens. Ironically, the groups doing the most to educate and implement protective strategies are the ones who have been involved in abuse scandals in the past (Churches, Scouts, etc). Even then, a lot of it is just getting clearances, which doesnt prevent people who where not caught or were first timers. Offenders get put on a list/map. This is sort of a half approach. If they are still a threat, they shouldn't be released. Yet if you comb the list and see some of the results, they don't all seem to fit with CSA. I personally know of 1 who took a leak across from a playground at 2am walking home from the bars and was put on the sex offender registry because it was within 500'.

It seems like these laws are more about peddling to the publicist and lawmakers fantasy of incrementally extreme punishment rather than taking a appropriate, data driven, and level-headed approach that actually protects kids. Otherwise they will just keep pushing ham-fisted low-hanging "fixes" like required scanning and IDs to access the internet.

twothreeone• 1 day ago

I think it's similar with other liability issues, e.g., when a company happens to "lose" customer data through a breach. They will be on the hook for not having certain audits and certifications at regular intervals. Practically never will anyone be feeling any pain due to absolute disregard for basic common sense precautions to prevent issues in the first place. So usually, the pattern is that issues that can be outsourced to insurance will be handled by compliance departments - which don't care about the actual problems, just that the fallout from them is "managed" accordingly.

giantg211• 1 day ago

That's actually a little funny. I work in compliance and we regularly work with the teams to improve processes that enhance security. I will say though, that the outsourced work that we send to consultants has the same sort of result you describe.

ribosometronome2• 1 day ago

One is far easier to prove. If the government could continuously monitor our actions "Is this CSA?" they might very well be pushing for that, too.

garyfirestorm• 1 day ago

if you wear red glasses...

inemesitaffia• 1 day ago

if that gets extended to

If you provide the government a platform to do So, they'll do Y if you wait long enough

inigyou26• 11 hours ago

Not everything is a slippery slope. Many things are, but you have to prove each specific case, not cite the general existence of slippery slopes.

rationalist14• 1 day ago

ones who have been involved in abuse scandals in the past (Churches, Scouts, etc)

And those groups still have lower rates of abuse than Schools which do a lot less training and enforcement of youth protection policies.

Children are still safer in Scouts and churches than in schools.

Just about every kid goes to school though, so people just prefer to sweep that under the rug and focus on targeting organizations they are not a part of or disagree with because they're easier to demonize and make fun of.

I work with kids, and I've had to take the Scouts and Catholic Church's youth protection training. They are both free to take online if anyone wants to check it out.

fluoridation7• 1 day ago

And those groups still have lower rates of abuse than Schools

Is that in absolute terms, or per child who frequents the establishment?

godwinson__4-85• 1 day ago

Does the school work to cover it up to the same extent? Are people across the school in on it? Are the rates of abuse higher on a per capita basis?

Why are you making apologies for (Catholic) church sex abuse? Because you are a member and you took a training? Yikes.

snozolli• 1 day ago

And those groups still have lower rates of abuse than Schools

What evidence do you have of this? The only sources I can find that would even vaguely support your claim switch to talking about physical abuse in schools, or sexual assault committed by fellow students.

To be clear, we're discussing the sexual assault of children by adults here. We're not talking about physical abuse, nor are we talking about assault by fellow students.

danaris3• 1 day ago

The problem is, the things that would actually prevent CSA require things like "giving children rights", "widely mandating effective age-appropriate sex education even for young children", and "admitting that it's mostly not scary strangers doing it."

These are utterly anathema to huge chunks of society, especially American society. It's more and more clear, from the scope of the Epstein Files, just how much of American society and government has been influenced specifically to enable easy access to children by rich white men. Even beyond that, the entire right wing would instantly catch fire if we actually required effective sex education. Especially age-appropriate sex education going right down to kindergarten (yes, kindergarten: the better children that age understand what's normal and safe, the better they can communicate when someone is doing things to them that are not that...and I only stop at kindergarten because AFAIK that's the earliest mandated schooling still). Similarly, the right wing desperately wants to have absolute control over their children—treat them as property—so giving children rights that even parents have to respect will get them to oppose absolutely everything.

Plus, as other sibling comments have already noted, the real desire here is for ubiquitous surveillance. CSAM is just the excuse they use.

throwaway898642• 1 day ago

Somehow, even something as simple as "age-appropriate sex education going right down to kindergarten" would tend to end up "special interests education from vocal minority groups."

Hasz• 1 day ago

Because it isn't about CSAM, IMO. You see this with plenty of social issues, notably firearms ownership. The claim is we will restrict/license/outlaw xyz for the kids, but really, a data-drive approach would have focused on different things entirely (eg additional behavioral health services for kids, suicide prevention etc)

The same technology/access used for CSAM identification can find copyrighted files, materials that don't support current government, etc. Full E2E encryption seriously raises the cost of mass surveillance, and why the US government fights it at every turn going back 30 years.

mschuster912• 23 hours ago

The claim is we will restrict/license/outlaw xyz for the kids, but really, a data-drive approach would have focused on different things entirely (eg additional behavioral health services for kids, suicide prevention etc)

Well, most of Europe simply has banned guns in the hands of civilians instead, so that's some data as well.

The only reason why the US is so extremely lax on firearms is because people keep blathering on about how guns are the last line of defense against a tyrannical government - and yet, what do the most rabid of these people do? Vote in and defend a literal tyrant.

kryogen1c• 23 hours ago

epsteins case tells you how much the US political class cares about SA and CSA happening in the US.

nativeit• 23 hours ago

When did we aggressively legislate against, search for, monitor, investigate, and prosecute owning firearms?

holgerschurig• 11 hours ago

The thing is that a society does not always do only ONE thing. You mentioned that there are better ways to protect kids. But maybe they cost more (e.g. banning firearms is dead cheap, while setting up a structure with lots of psychologists specialized in teenager problems is really expensive).

Also you can do one and the other ... at the same time. E.g. suicides of kids/teenagers (<= 19) in Germany in 2025: 216. That is, compared to the population in this age group, 1.38 per 100'000. In the USA that ratio is 9.4 in the age-group 15-19 and 2.3 in the age group 10-14.

And keep in mind, the total deaths by firearms in Germany in 2024 was "just" 168 (we have 1/4th of the US population, in the US police forces alone killed more people ... the total number of 44'000 firearms deaths in USA/2024 is even more staggering). Even if I multiply the 168 by 4 for the population difference ... then 672 vs. 44'000 is still a point of shame for the USA.

So in Germany, we do BOTH better regarding firearms AND regarding health services on kids. And if the USA truly would try MAGA they'd actually copy good results from other countries. So a real-MAGA-person must be against liberal firearms distribution AND for better social health work with teenagers.

BTW, the USA ideology of "the population needs arms to fight a corrupt state" is laughable. When you had your armed religious sects clash with the state, then the state always won. They still have more and better weapons and armor. On the other side, if you look how east-europe shed off their socialist regimes 40 years ago, than nowhere was an armed general population involved. So one can conclude that private firearms may as well be highly regulated and diminshed.

guerrilla• 1 day ago

In Sweden we're going to literally have Minority Report style pre-crime registries for potential child molesters. We already have one for potential domestic abusers. Fuck this country. I need to get out of here before it gets worse.

hansvm• 1 day ago

Say what now? What criteria do they use to scan the populace and create a pre-crime registry of any kind?

wredcoll• 21 hours ago

What? Since when? What are you talking about?

Scroll_Swe• 8 hours ago

And get ready for more refugees when the left wins... 2015 here we go again. Öppna era hjärtan...

I won't leave. I was born here, and my ancestors were too and this is my beautiful country.

manoDev• 1 day ago

CSAM is the perfect trojan horse to undermine privacy everywhere. No politician and no company can oppose it on the grounds of protecting privacy before having the reputation ruined.

Meanwhile the real pedos are rich people vacationing in well known places.

inigyou26• 11 hours ago

Are you sure? Can't they say "yeah pedophilia is fucked up but reading all our emails is also fucked up"?

Spooky233• 1 day ago

The CSAM issue is both very real and abused by politicians. When I did some work with a police agency, it was explained to me that there’s a pattern of escalation with people and they tend to accumulate collections and many escalate to actual behavior.

The detectives assigned to this work tend to not last long, and the horrific nature of the crime affects them.

Like all rape, it’s a combo of control and dopamine. The church and Boy Scout leaders leveraged their societial influence and power to compel compliance and even loyalty from their victims. Boy Scouts as an organization inserted itself into existing power structures like church, police and other institutions. It’s difficult for a 11 year old victim to make an accusation about a beloved community figure. They also tend to find ways to make their victims feel complicit. Even if people come forward, they are hard cases to try and exposes young victims to public shame. Many of these people plea to lesser crimes to protect the victim.

I wasn’t a victim thank god, but a Boy Scout leader at my parish was a serial molester who abused dozens or hundreds of children. I learned about it years later and realized that some of my friends were almost certainly victims — in his case everyone in authority just blew it off

lstodd• 22 hours ago

When I did some work with a police agency, it was explained to me that there’s a pattern of escalation with people

You have been mildly brainwashed.

It would be best if that episode lead you to study a bit of psychology but instead you chose to believe.

Like any belief it's a combo of control and dopamine. The feeling of belonging to a group and being righteous within that group hits so hard that it takes hard explicit effort to screen your perception of its effects.

You are a victim because you failed to accept reality.

xyz12349992• 15 hours ago

there’s a pattern of escalation with people and they tend to accumulate collections and many escalate to actual behavior

I was curious about this. I did find some research here: https://www.suojellaanlapsia.fi/en/post/csam-users-in-the-da... (2021)

That paper states

Traditional research on individuals who use CSAM is often inherently biased as it has focused primarily on convicted and known offenders.

and appears to be directly trying to avoid that bias, which is good to see.

Isn't there still some bias here though? They only got answers from 1. people who were using a dark web search engine with ads, 2. felt the need to click a "Help us to help you" link, 3. were willing to discuss the topic with strangers on the web. Only (3) was (almost) acknowledged in the Limitations section.

They concluded that "Many CSAM users are not just viewers" and, while "many" could mean any number, I think readers would probably take it to mean something like 30% (shown in graphs) which isn't indicated by their data.

Furthermore, the "not just viewers" conclusion is from a question about "seeking direct contact with children through online platforms". I'm not sure why they didn't more directly ask if respondents took action towards abusing children, with the inspecific "direct contact" qualifier and very specific qualifier "through online platforms". I wonder what the results would have been if they removed "direct" and "through online platforms" from the question.

Admittedly I don't know a lot about statistical techniques! Has there been other research, or do you know what the police agency was basing their explanation on?

wickedsight• 15 hours ago

This is correct. Also, the people who produce CSAM usually don't just stop, so tracking down material, especially new and unknown, is one of the most important ways to stop active abuse. Also because the material is actual proof and many (C)SA cases fail due to lack of exactly that.

This doesn't mean I agree with active scanning of things like iCloud, effectively making everyone a suspect, but counter to what people here seem to think it really might help prevent CSA.

belorn3• 12 hours ago

Lets look at this specific situation. Was there regulation that dictate/encourage screening and education for organizations that work with children? How many adults were there in the organization and on activities with this scout leader? How much involvement had parents? Was there any adult in the children environment that was trained to detect CSA, for example school personal?

It is technical possible that in small villages there is only a single Boy Scout leader and no other adults, who then spend a lot of time alone with children. In my experience however, after school activities involving children also generally involve several adults. That makes it a major structural issue among the adults if they fail to detect a problem like hundreds of victims, and the more common remedy would be to train people, apply some form of screening, and change routines that limit risk and encourage reporting in case of inappropriate behavior.

In addition, having trained people that regular meet and talk to children can help detect situations even when they happen in peoples home, like having school employees training in detecting signs of CSA.

rootusrootus7• 1 day ago

On the CSA side, you rarely hear about arrests (they happen but less than CSAM).

Because it is nearly always someone we know. Someone who we just cannot imagine would ever do such a thing, even when the evidence is glaringly obvious. And I suspect that the fraction of the population diddling kids in real life is breathtaking, and nobody really wants to face that head on. Too uncomfortable.

I could just be overly cynical today. But given my own experiences and other people I've known throughout my life, I really believe it is very common.

brabel2• 13 hours ago

I thought it had never happened around me in my whole life, but my sister recently told me that when she just in primary school, a friend of my dad gave her a lift and while she was in the car, inserted his fingers on her. Like WTF! I really had no idea this could have happened in my environment. I guess it probably happened more than I know to others too uncomfortable to say anything, took my sister 30 years to say something.

hn_acker• 23 hours ago

There doesn't seem to be any real push for educating and protecting kids before it happens.

Before abstinence and birth control, CSA prevention should be the primary goal of sex ed in schools, especially before high school. (Though on birth control [1] and probably STIs as well the US is not doing well.)

[1] https://www.plannedparenthoodaction.org/issues/sex-education...

throwaway2037• 23 hours ago

    > yet almost nothing seems to be done to prevent CSA

    > On the CSA side, ... [t]here doesn't seem to be any real push for educating and protecting kids before it happens.

This is a mighty wide brush you are painting with. When I was growing up, from very early (elementary school), we had "health class" where the teacher would teach you things about your body and health. This also included who is allowed to see you naked and/or touch your private parts. They also explained how to get help if someone what touching you inappropriately. That effort seems pretty active to me.

    > I personally know of 1 who took a leak across from a playground at 2am walking home from the bars and was put on the sex offender registry because it was within 500'.

Urinating in public late at night is an interesting category of inprobably CSA-labeled behaviour. It should be treated with kid gloves -- the context matters.

rationalist14• 22 hours ago

This also included who is allowed to see you naked and/or touch your private parts. They also explained how to get help if someone what touching you inappropriately. That effort seems pretty active to me.

My school did not cover that (but at least my parents did).

basilikum5• 23 hours ago

To play devil's advocate: child abuse is usually a crime without direct evidence. CSAM is child abuse but the perpetrator films their crime as evidence. Everyone else who obtains and keeps this material also holds evidence against themselves as the possession of it is the crime.

Now for real: People often do not care a lot about child abuse. It does not affect them as it happens in private where they do not see it. CSAM however does affect them as it makes the abuse visible and shows something deemed reprehensible. In a lot of ways people see themselves being witness (even indirect by purely hearing about it) to CSAM as the victim rather than the children who are harmed in the making and by redistribution.

My cynical opinion is that it is a lot more about social norms and feelings arising from the violation of these norms rather than the harm done through the violation of children.

skissane2• 22 hours ago

CSAM is child abuse but the perpetrator films their crime as evidence

This isn't entirely true. In much of the Western world – outside the US – CSAM (or equivalent legal terms such as "child pornography", "child abuse material", "child exploitation material", etc) can include text, drawings, AI-generated imagery, etc, which no child was abused to create, indeed the child depicted in it may be entirely fictional. Canadian law goes so far as to treat material which "advocates or counsels" the commission of CSA as CSAM - which the Supreme Court of Canada insisted (in the 2001 case of R v Sharpe) doesn't include mere political advocacy for its legalisation (as in e.g. the NAMBLA Bulletin), although some will question whether that insistence actually cashes out in practice.

Now, as a father of school-aged children, I find the whole idea of groups like NAMBLA rather abhorrent – but, I'm hesitant about the government making it illegal for people to express abhorrent ideas, because there are likely ideas which you or I hold which somebody out there considers abhorrent.

basilikum5• 23 hours ago

I personally know of 1 who took a leak across from a playground at 2am walking home from the bars and was put on the sex offender registry because it was within 500'.

You might want to look up if that's actually true. It might be. It might also be a lie to hide the real reason why they are registered.

dijit3• 22 hours ago

on the flip side, imagine if it's true and everyone immediately suspects that you're a pedophile trying to appear innocent.

Talk about tainted for life.

teaearlgraycold3• 21 hours ago

What’s up with the cop that cited them for that?

seanmcdirmid• 22 hours ago

CSAM laws in many jurisdictions include computer generated or hand crafted media that do not pre-require CSA at all. The idea is that deviance leads to CSA, and by cracking down on CSAM, we are preventing CSA.

teaearlgraycold3• 21 hours ago

The US constitution should require proof of harm to a living thing as a prerequisite for criminal charges.

brabel2• 13 hours ago

This is such a slippery slope. It amounts to thought police. You did not actually cause any harm, but thought of doing something. Where do we stop ? If I fantasize about my pretty coworker without her consent, am I a rapist now? What if I make a sketch of her naked? Is that a crime? What if I ask AI to remove her clothes from a real picture? Even if I just immediately delete it?? I guess that there’s different levels to each “offense”, and at one level it does become criminal, but it’s hard to unequivocally decide where.

NordStreamYacht• 21 hours ago

These laws are a pretext to remove anonymity on the internet and insert backdoors into everything.

matheusmoreira• 20 hours ago

It's not about children. It was never about children. How many politicians have gotten caught in Epstein's island by now?

It's all about surveilling the masses and keeping them under control. Children are merely one of the political weapons they use to make the masses accept any proposed solution, no matter how Orwellian. You're not against protecting children from drug trafficking, money laundering, child molesting terrorists, are you?

nsonha• 18 hours ago

I don't know how to say this and not sound like a CSAM or CSA offender but CSAM policing sounds too much thought policing to me, if you wanna police CSA just go and do it, don't police what people have in their mind.

BLKNSLVR• 18 hours ago

The lowest of the low hanging political points scoring fruit will be picked.

I make this point on HN each time it comes up: Dealing with actual CSA requires actual people going to investigate actual reports of children's living conditions out in the real world, not "scanning digital files". Seems obvious when you say it like that, but the alternative seems to still score heavily on the political scale. Ironically, spending more money on "scanning digital files" takes away from resources that could prevent those digital files from being created in the first place, so all the additional time, money, and effort towards combatting CSAM is time, money, and effort specifically _not_ working against stopping CSA. It's categorically _not_ protecting the children.

Teachers, in Australia at least, have mandatory reporting where any kind of abuse is suspected. The heart-breaking irony is that the resources to investigate the reports are so scarce that they can only respond to reports where the child's life is in immediate danger.

Caveat: the above was true a few years ago, I genuinely don't know if it's still true. What I do know is that 'social work' isn't suddenly a high paying job, so I doubt resource availability has changed much.

There is no easy answer to this. It's entirely nuance.

EagnaIonat• 16 hours ago

Seems obvious when you say it like that,

That's exactly what happens. CSAM has two parts to it.

The first is the known and most horrific videos of CP out there. These aren't shared, instead only hashes are used to determine if the image/video matches. It's next to impossible to get an mis-hit on that.

The second is nudity and age detection AI. Apple has this on their devices, but warns the user before sharing not reporting.

It normally takes more than one hit to get flagged for investigation. At that point law enforcement are informed and take over.

The majority of investigations are children sending naked pictures of themself to their friends.

So it is absolutely being used as the purpose to protect children and it's amazing how many people don't realise how it works when they are very transparent about it.

Of course it is not without its issues that need to fixed. For example providers will just ban the person before it's determined if they broke a law or not.

Thlom• 8 hours ago

Children also need to understand that they have been abused and know who they can talk to for them to be able to report abuse to a trusted adult. Unfortunately that requires children to learn about sexuality and autonomy which for some reason conservatives think is abuse to teach children.

sneak• 17 hours ago

It’s nothing to do with CSAM and all about surveilling who has which files and when, and who they send them to.

Even ADP in iCloud sends the hashes of the plaintext to Apple, non-e2ee. This allows them to see who has unique files, and when, and the networks of users to which they spread, and when.

superxpro12• 17 hours ago

Yeah DUH. its a trojan horse to eliminate any privacy in the populace, except for the government and elites, of course. They get privacy. You dont. How else are they going to maintain control over the populace?

Kalibr• 16 hours ago

Arresting for CSAM is easy and brings in a lot of money. It’s a slam dunk case for just possession. Investigating and prosecuting people for CSA takes a lot of manpower and time for single case and not nearly as profitable. As usual, follow the money.

one33seven2• 15 hours ago

It is not about CSAM, it's about scanning our data. If it were about kids safety there would be lots of people in jail

Cthulhu_• 14 hours ago

Theory besides what others have said: remove the supply and you affect the demand. That's the theory anyway, I'm not sure it works like that; to make a parallel, punishing drug users didn't affect dealers/supply networks.

elil17• 14 hours ago

My thought is that many different stakeholders have reasons to focus on CSAM:

- Prosecutors want to go after it because it is much easier to prove than CSA.

- Authoritarians want to go after it because it gives them a chance to get things like ID checks accepted by the public.

- People who genuinely want to prevent CSA focus on it because a large amount of CSAM is made by serial abusers - so capturing producers can prevent future abuse. Additionally, they believe (with good reasons) that CSAM consumption is a gateway to CSA and CSAM production for many people. Further, finding CSAM can be a way to identify and rescue children from abusive situations.

- CSA survivors may advocate for it often feel traumatized not just by the abuse, but by the fact that people might be continuously viewing that abuse.

- Going after it winds up creating digital forensics specialists and task forces, which creates a special interest group within police departments which wants to continue focusing on CSAM but is not set up to do anything about CSA.

I would recommend the podcast Hunting Warhead to anyone interested in learning more about this.

benj111• 14 hours ago

I'd like to know the link between availability of csam and CSA. There seems to be an assumption that the former causes the latter.

That's not to say it's acceptable if illegally produced.

We have issues in the UK. So far they've banned 'rape' porn. And now they're talking about 'barely legal'

None of this seems to be based on any statistics showing this is actually harmful in any way.

inigyou26• 11 hours ago

If they ban "barely legal" the next thing will be "barely not barely legal" and they'll ban that, and they'll have "barely not barely not barely legal" and so on...

miki123211• 14 hours ago

CSA doesn't neatly fit into a narrative.

If there's a person committing abuse against a child, usually a family member in their own household, there's no story there. They (hopefully) get arrested, get a minor mention in the media if that, and life moves on.

If, on the other hand, they send CSAM using a platform, device or protocol, then clearly the makers of that technology failed to uphold their sacred duty to protect the child. If most CSAM cases happen using a few major technologies (and they will, because societies tend to standardize on what technologies they use for communication), the technologies get blamed for the problem they supposedly enable.

If you dislike the technology for other reasons (the distrust of corporations from left-leaning politicians, censorship allegations on the right, a moral panic about the impact of smartphones on children's mental health), you can use people's misunderstanding of statistics to exaggerate the CSAM problem, blame the tech, and gain some notion of control over it in a way that is politically palatable to citizens.

It's worth saying explicitly that centralization doesn't have much to do with this. We've seen similar stories play out with bicycles, Walkmans, pagers, AI, heavy metal and Uber rapes. They were different moral panics, but the mechanic was roughly the same. I think the situation wouldn't change much if we all used PGP-encrypted email over personal mail servers to communicate.

An exception that proves the rule is the moral panic over CSA in primarily-catholic countries, notably relating to abuse committed by catholic priests, which are statistically no more likely to commit it than anybody else. As the influence of the Church on government policy is a hotly-debated topic in those countries, CSA is suddenly an issue that people can use to further their political causes.

0dayz• 14 hours ago

Sorry but I'm intrigued, what was the moral panic about bicycles and Walkman?

setgree• 12 hours ago

First, I think it’s likely that you hear more about one than the other because you read websites like Hacker News and are not (I assume) an FBI agent or someone else who works on this stuff. A public defender I know would say that child abuse of all sorts is ever-present and relevant to their work, unfortunately.

Second, detecting CSAM leads to its producers who are by definition abusers. Here’s a nice article in Wired about the digital forensics of cracking down on a CSAM ring with some interesting details about the role played by crypto, and abusers’ misconceptions about it: https://www.wired.com/story/tracers-in-the-dark-welcome-to-v...

With that said, I agree that a lot of political concern for this is a smokescreen for a creating more surveillance. “think of the children!” has the flavor of a rhetorical trump card.

KaiserPro5• 9 hours ago

yet almost nothing seems to be done to prevent CSA.

for the UK, there has been a massive shift to prevent this kind of stuff.

anyone who even volunteers with children or vulnerable adults needs to be screened. Charities are required to have policies for dealing with vulnerable people safely.

but to the point, Apple halfarse CSAM reporting.

Whatsapp which doesn't do "CSAM scanning" reports in one hour more CSAM than apple does in a year. From memory meta (instgram, facebook and whatsapp) reported millions of cases of CSAM for 2021, compared to apple's ~250 (not thousand, just 250)

for facebook its automated scanning, but for whatsapp, its just design. its really obvious how to report a message/image. in imessage, its impossible, there is no mechanism to long press/select/other a message.

Now, Facebook are bastards in virtually every way, but for whatsapp at least, they have made GUI changes that have real positive impact on CSAM protection.

Apple has not.

They made some noise about hashing, but thats invasive and ironically noisier than having user reports.

john_strinlai5• 8 hours ago

anyone who even volunteers with children or vulnerable adults needs to be screened

as far as i am aware, that is common practice in many countries. the problem is that screening is typically a quick check of "has this person been suspected or arrested for something involving minors already" and perhaps a few questions on a piece of paper. its not like they give everyone volunteering for a fieldtrip an extensive 1:1 with a psychologist and an mri. any predator who has not previously been caught will easily pass screening.

From memory meta (instgram, facebook and whatsapp) reported millions of cases of CSAM for 2021, compared to apple's ~250 (not thousand, just 250)

easy enough to explain. instagram and facebook are social media with billions of public posts. whatsapp is in a similar enough boat, with large (up to 1000 participants?) facebook-like groups of otherwise strangers and a lot of marketing and inertia for social-media-like use.

i imagine instagram is a majority of it. it's disgusting on there.

on the other hand, apple is not a social media company nor facilitates large group chats (imessage goes up to 32 participants).

i doubt adding an easier UX for reporting would make a material difference in the number of reports apple submits because you're typically already talking with people you know when using imessage.

summerlight• 6 hours ago

There is a pretty simple yet disappointing reason. CSAM is much easier to investigate and prosecute. You got evidence, you prosecute. Almost guaranteed conviction. You can even enforce big tech to implement proactive monitoring systems.

Compared to this, CSA is much harder. Every case is different. You have to do due diligence. And it is extremely hard to proactively detect them. Careful criminals will destroy all evidence. The number of case itself is smaller. And there is a good chance to lose in the court and for prosecutors this is a clearly risky move. Good ol' criminal investigation is expensive. There is a structural reason not to prioritize them.

The whole incentive structure is broken. The only thing to fix this is external pressure, but even it does not work these days. Exposing CSA is a rare event but media needs constant, sensitive headlines so they tend to treat CSA and CSAM like the same thing. Hence external pressures do not work, and even worse those work in a wrong way. This creates a bad feedback loop.

gradschool• 6 hours ago

This has even extended to fictional CSAM such as AI generated stories and pictures.

Peripheral to your comment, there is an argument against AI generated CSAM that no one seems to be making so allow me. AI will do the same for CSAM as it has already done for copyright laundering. That is, it will enable its distributors to train their models on real CSAM while obscuring the training material. A legal regime that permits unrestricted distribution of AI generated CSAM incentivizes actual abuse as a source of training material. If one opposes legal prohibitions on free speech grounds, then at a minimum there should be an audit requirement incumbent on AI generated CSAM distributors to document their process in sufficient detail as to establish that they haven't used actual CSAM for training, similarly to the way porn distributors are required to document that their models are of legal age.

crest• 1 day ago

You wouldn't hold the postal service accountable for delivering CSAM or a bank for offering storing it a lock box would you? So why should cloud storage services be different? Stop clutching your pearls and welcoming big brother over imagined threats while a real rapist sits in the oval office!

kristopolous• 23 hours ago

If you're going to be committing a crime, why would you store it in a cloud service?

Retr0id• 21 hours ago

Cloud storage is practically the default these days, and most users have no clue where their files are.

pixl977• 9 hours ago

Because companies love turning things like this on by default.

VerifiedReports• 20 hours ago

Whatever "CSAM" is...

unselect5917• 14 hours ago

A perfectly safe panopticon and freedom & privacy will always be at odds.

Don't let a classic "think of the children" appeal to emotion short circuit your reasoning.

KolibriFly• 14 hours ago

A court should not quietly create a general duty to inspect everyone's private files because a provider could theoretically detect illegal content

Schlagbohrer• 8 hours ago

I have to point out that the united states absolutely does not, under any context, care about the health and wellbeing of children. If they did they would have good, easy to access free healthcare and support for families including parental leave, as well as a good public school system that served every single child adequately.

Apple defeats liability for not scanning iCloud for CSAM

Related Stories