{"id":9962,"date":"2021-09-08T14:40:15","date_gmt":"2021-09-08T18:40:15","guid":{"rendered":"https:\/\/irreal.org\/blog\/?p=9962"},"modified":"2021-09-08T14:40:15","modified_gmt":"2021-09-08T18:40:15","slug":"the-technical-problems-with-apples-csam-scanning","status":"publish","type":"post","link":"https:\/\/irreal.org\/blog\/?p=9962","title":{"rendered":"The Technical Problems with Apple’s CSAM Scanning"},"content":{"rendered":"

I\u2019ve written several posts (1<\/a>, 2<\/a>, 3<\/a>, 4<\/a>, 5<\/a>, 6<\/a>, 7<\/a>) about Apple\u2019s planned CSAM scanning project but those posts have always focused on how Apple was betraying their long held promise to protect our privacy and not allow random snooping through our iPhones. To me, that\u2019s the most important aspect of the controversy: it\u2019s really important\u2014at least to me\u2014to feel secure that your smartphone is not collecting information about you and reporting it to the government or anyone else.<\/p>\n

This post is a quick look at the other reasons to be against Apple\u2019s plan. I\u2019ve collected them under the rubric of \u201cTechnical problems\u201d but, strictly speaking, they aren\u2019t all \u201ctechnical.\u201d<\/p>\n

The first issue is that the matching is based on hashing CSAM images and comparing the hash against images on the phone. The problem is collisions. Hashing is a way of reducing any sequence of bits, say \\(n\\) long, to a sequence of \\(m \u226a n\\) bits. That necessarily means that more than one sequence of bits will reduce to the same \\(m\\) bit value. In terms of Apple\u2019s system, that means that more than 1 image will have the same hash value.<\/p>\n

Hashing algorithms generally deal with these collisions by comparing the two values that were hashed to make sure they\u2019re a match but that\u2019s not possible here because it\u2019s illegal a have a copy of the actual CSAM image, let alone to download it to billions of iPhones. To a first order of approximation, Apple treats identical hash values as a match. It protects against ambiguity by two means:<\/p>\n

    \n
  1. The number of matches have to exceed a threshold (\\(\u224830\\)) before Apple even looks at the results.<\/li>\n
  2. Even when the threshold is exceeded a human being looks at the potentially matching images to make sure they really are child porn.<\/li>\n<\/ol>\n

    Apple\u2019s protocol is more robust than I\u2019ve recounted here (see this technical summary<\/a> and this paper detailing the theoretical details<\/a>). Among other things it\u2019s resistant against hackers generating false matches or pedophiles discovering offending hashes so they can bypass them. In addition, Apple is prevented by technical means from seeing any of the potential matches until the threshold is exceeded. Despite some folks generating images that hash to the same value (1<\/a>, 2<\/a>), Apple\u2019s protocol seems to me to be pretty robust against such attacks.<\/p>\n

    That\u2019s bad news for Apple\u2019s hope of refining and reintroducing their plan. It\u2019s hard to see how anything like the current plan could be more secure so any changes are likely to be eyewash.<\/p>\n

    But the real danger with Apple\u2019s plan is something out of their control: that the machinery for CSAM scanning will be repurposed for other, less savory purposes. Apple. of course, says that they will refuse to let it happen but that claim is empty. When presented with a court order or law demanding that they scan for, say, terrorist images or content, they will have no choice but to comply. And that doesn\u2019t begin to address what they will do when China and others bring economic pressure to bear. Apples CSAM scanning machinery is easy to adapt for other types of content monitoring. It\u2019s really not something you want on your phone.<\/p>\n

    This isn\u2019t just paranoid ravings. The developers of the algorithm that Apple uses have written a WAPO op-ed<\/a> in which they say that they concluded the algorithm was too dangerous to be used precisely because of its potential for abuse. If you read none of the other links from this post, you should read that one.<\/p>\n

    The takeaway from all this is that Apple should, once and for all, abandon this project. The dangers are manifest and the benefits few. Those dealing with CSAM images can easily work around Apple\u2019s scanning and the rest of us will be paying with our privacy for nothing. Part of problem is that Apple\u2019s protocol is clever and a nice piece of engineering. Those involved with its development are doubtless in love with the result and will hate to throw it away but that\u2019s the right thing to do.<\/p>\n","protected":false},"excerpt":{"rendered":"

    I\u2019ve written several posts (1, 2, 3, 4, 5, 6, 7) about Apple\u2019s planned CSAM scanning project but those posts have always focused on how Apple was betraying their long held promise to protect our privacy and not allow random … Continue reading →<\/span><\/a><\/p>\n","protected":false},"author":2,"featured_media":0,"comment_status":"open","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[5],"tags":[21,62,3],"class_list":["post-9962","post","type-post","status-publish","format-standard","hentry","category-general","tag-apple","tag-privacy","tag-security"],"_links":{"self":[{"href":"https:\/\/irreal.org\/blog\/index.php?rest_route=\/wp\/v2\/posts\/9962","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/irreal.org\/blog\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/irreal.org\/blog\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/irreal.org\/blog\/index.php?rest_route=\/wp\/v2\/users\/2"}],"replies":[{"embeddable":true,"href":"https:\/\/irreal.org\/blog\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=9962"}],"version-history":[{"count":1,"href":"https:\/\/irreal.org\/blog\/index.php?rest_route=\/wp\/v2\/posts\/9962\/revisions"}],"predecessor-version":[{"id":9963,"href":"https:\/\/irreal.org\/blog\/index.php?rest_route=\/wp\/v2\/posts\/9962\/revisions\/9963"}],"wp:attachment":[{"href":"https:\/\/irreal.org\/blog\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=9962"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/irreal.org\/blog\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=9962"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/irreal.org\/blog\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=9962"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}