Apple’s new Child Sexual Abuse Material (CSAM) detection system has received some criticism for its potential data privacy violations. And Edward Snowden has gone as far as to say: “Apple’s new system, regardless of how anyone tries to justify it, will permanently redefine what belongs to you, and what belongs to them.”
What do you think, is it a bad seed? If an Apple employee walked into your home and started flicking through your photo albums would you feel OK about it?
Seeing as we don’t know how far the new system will look, and there are no assurances from Apple on this so far, the Switch2IT team is uneasy about its snooping potential. And then there are the concerns about how far the tech giant goes to protect its employees’ data privacy… Perhaps Apple’s rotten to its core.
The new CSAM detection system
Last month, as reported in Forbes, Apple announced its new CSAM detection system. This is an on-device (iPhone, iPad and Mac) screener for photos that users send to iCloud and it checks images against illegal material. Apple said: “We want to help protect children from predators who use communication tools to recruit and exploit them and limit the spread of Child Sexual Abuse Material.”
This announcement followed the National Center for Missing and Exploited Children’s (NCMEC) revelation that Apple’s reports for last year were seriously lacking when compared to other tech giants: “In 2020, the NCMEC received 21.7 million CSAM reports, up from 16.9 million in 2019. Facebook topped the 2020 list – making 20.3 million reports last year. Google made 546,704; Dropbox 20,928; Twitter 65,062, Microsoft 96,776; and Snapchat 144,095. Apple made just 265 CSAM reports to NCMEC in 2020.”
Why so many data privacy concerns?
This new detection system however has caused quite a backlash regarding data privacy with over 90 global information privacy groups complaining directly to Apple. While many tech companies scan images sent or uploaded once they hit their servers, Apple’s approach has upset the proverbial cart by proposing to scan people’s devices instead.
Using the new system, Apple plans to manually review each report to confirm a match for illegal material. They will disable the user’s account and forward a report to NCMEC. Then, any users that feel their accounts have been flagged in error can appeal to have their accounts reinstated.
ESET’s Jake Moore states, “…it highlights the power in which Apple holds with the ability to read what is on devices and match any images to those known on a database. This intrusion is growing with intensity and often packaged in a way that is for the greater good.”
Edward Snowden adds: “Under the new design, your phone will now perform these searches on Apple’s behalf before your photos have even reached their iCloud servers, and… if enough “forbidden content” is discovered, law-enforcement will be notified. Apple plans to erase the boundary dividing which devices work for you, and which devices work for them.”
And what if the government get their hands on it? Victoria Baines, a cyber security expert who has worked at Facebook and Europol on child safety investigations, raised concerns that similar technology has been used to detect terror-related materials following political pressure.
As a result of data privacy criticisms, Apple delayed plans to introduce the detection technology on its devices. In a statement, reported by Tech HQ, the tech giant said: “Based on feedback from customers, advocacy groups, researchers, and others, we have decided to take additional time over the coming months to collect input and make improvements before releasing these critically important child safety features.”
Apple’s data privacy: rotten to the core?
But it seems that user data privacy is not the only thing in apple pie order at Steve Jobs’ legacy. When it was revealed last month that an employee was required to link his personal Apple ID and work account, Switch2IT’s data protection hackles were raised again. This excerpt from an article by Zoe Schiffer of The Verge gives further insight:
“How could he be sure his personal messages and documents wouldn’t land on his work laptop? Still, he was too giddy about his new job as a firmware engineer to care. He went ahead and linked the accounts.
“Three years later, when Preston handed in his resignation, the choice came back to haunt him. His manager told him to return his work laptop, and — per Apple protocol — said he shouldn’t wipe the computer’s hard drive. His initial worry had come to pass: his personal messages were on this work laptop, as were private documents concerning his taxes and a recent home loan. Preston pushed back, saying some of the files contained highly personal information and there was no reasonable way to make sure they were all removed from the laptop without wiping it completely.
“He was told the policy wasn’t negotiable.”
This is just the start. Some Apple employees have been asked to install software on their phones to test new features before launch and have then had the builds expose their personal messages. While others found that testing new products, like Apple’s Face ID, resulted in images recorded whenever they open their phones. What is more, unable to use their work email addresses to sign up for iCloud accounts, employees have again been pushed to use personal accounts.
There has been some serious blurring of lines and then when Apple tells employees they should have “no expectation of privacy when using your or someone else’s personal devices for Apple business, when using Apple systems or networks, or when on Apple premises” staff are left with barely a leg to stand on.
While we are sure this type of behaviour is not limited to Apple, there are some bad seeds here. And when it comes to a company that is purportedly dedicated to data privacy it is hard not to raise your eyebrows – at the very least. We think, considering everything, Apple needs to up its data privacy game and do away with this apple of discord! Especially as consumers’ options are so limited – Apple or Google. Surely this is a case the Competition and Markets Authority should be taking seriously too…
Switch2IT to help protect your data privacy
With your cyber security always at the forefront of our minds, you can rely on Switch2IT’s technical support services. We can provide you with a cyber security strategy – for cloud services and business devices – that includes safe data backups. We can also advise on data privacy best-practice and make sure your employees and clients gain maximum protection. To find out more, fill out our online form or give us a call on 0800 083 3416.
