| >All of which has been common for a long time No, this has never been done before. >You where already sending your unencrypted phots to Apple No, I wasn't. The whole point here is that Apple is not scanning server side, they've built the functionality to scan device side. You need never use iCloud in any way whatsoever in order for Apple's new scanning tech to be used against you. That is a major difference. >Apple and all other service providers are required by US and most other countries laws to do searches on their servers. No, they are not, even if that was the new thing Apple is doing which it isn't. If a company builds server-side scanning, then they may be required to fulfill certain requirements. But companies are not required to actually do that in the first place even if many choose to do so. Apple already did scan uploaded photos and voluntarily chose not to have E2EE for iCloud data in order to please law enforcement agencies, but that's a voluntary choice by Apple. This new client side scanning is a different beast. Please try to gain even the slightest fucking clue what you are talking about before spouting off on something so important. Edit: to add for those interested in more details on the law, the federal reporting requirements are under 18 U.S. Code § 2258A [0]. What you'll see there is a "Duty To Report", and the reason for that is to evade Constitutional protections. If the government compelled companies to scan, as well as any legal challenges (by very well funded actors) and public blow back, as a practical matter those companies would become State Actors for the purposes of 4th Amendment evaluation. However, even if it's heavily incentivized so long as it's "voluntary" courts have repeated ruled that 3rd parties can do searches that would be illegal for the government, turn discovered evidence over to the government who in turn may then use it freely. Walter v. United States (1980, [1]) is a good example, covering the [righteous and just prosecution] of someone transporting "films depicting homosexual activities" after it was mailed to the wrong address and turned over to the FBI which I'm sure everyone here on HN would applaud and definitely is what they have in mind when they think of client side scanning in the US. Tim Cook is carrying on that tradition with Pride no doubt. ---- 0: https://www.law.cornell.edu/uscode/text/18/2258A 1: https://www.oyez.org/cases/1979/79-67 |
False. Apple complies with the laws pertaining to customer data and provides data as legally required. III. Information Available from Apple
J. iCloud
https://www.apple.com/legal/privacy/law-enforcement-guidelin...
> You need never use iCloud in any way whatsoever in order for Apple's new scanning tech to be used against you.
False. Phones don’t download the CSAM hashes so they can’t do device side scanning as they have nothing to compare the images to. Yes, the phone uploads a hash, but they also upload the unencrypted images along side it.
Thus the only thing that changes is Apple isn’t paying for the compute power to do the hashing. That and a tiny amount of extra bandwidth on uploading images.
PS: In response to your edit, perceptual hashes are a grey area. However, as long as a judge agrees they can very much just take down production systems when it pertains to a case. That’s a rather big stick to force compliance even if it’s not an explicit law it’s very much a consequence of it. Thus companies really don’t push back as some that have simply got raided.