Apple is Adding Tech to Look At Your Photos For Child Abuse
Craig Peterson - Secure Your Business, Your Privacy, and Save Your Sanity
Release Date: 08/21/2021
Craig Peterson - Secure Your Business, Your Privacy, and Save Your Sanity
A listener asked Matt to ask Craig about the theft of FBI data, and Craig started with who holds it. Much of what the federal government keeps — background-check records, applications to the FBI, even the designs of weapons made by defense contractors — sits with third parties. The group behind this one is called ShinyHunters; its reported leader was arrested by Dutch police the day before the show. Craig’s point was the gap between the government and its vendors: last week every federal agency was required to patch ScreenConnect, a remote-support tool with a serious vulnerability....
info_outlineCraig Peterson - Secure Your Business, Your Privacy, and Save Your Sanity
On October 13, Microsoft ends support for Office 2021 — Word, Excel, Outlook, and PowerPoint stop receiving security patches that day — along with the extended security updates for Windows Server 2012. Danny, sitting in for Jim Polito, asked the obvious follow-up: how does anyone find out what they are running? Craig’s answer started with what people assume covers them. “Most people think, oh, I’ve got antivirus software. I’ve got Windows Update turned on. So, I’m all set. It is not true.” Windows Update does not update all the software on a Windows machine, and antivirus only...
info_outlineCraig Peterson - Secure Your Business, Your Privacy, and Save Your Sanity
Sen. Mark Warner went to the Senate floor to call for a government body to oversee AI. Craig read the legislation and the senator’s website before the show, and his objection was that the problem it describes is already illegal. Laws against hacking a computer system have been on the books for almost 30 years; people have gone to jail under them, foreign nationals included. “I think what they’re trying to do is get legislation that protects them from the laws that exist.” Jeff played the other side: if the AI gets loose because of “grossly incompetent nitwits that I chose to...
info_outlineCraig Peterson - Secure Your Business, Your Privacy, and Save Your Sanity
OpenAI launched ChatGPT 6, Sol, and Luna this month, claiming Sol makes about half as many mistakes as the models before it. Matt asked whether that is real progress. Craig’s answer was yes, with a catch: the models are not getting smarter. The companies, Anthropic included, have rewritten the code around them so the AI runs the same prompt again and again from different angles and then votes on the most likely answer. The new models use about twice the tokens of the old ones. “And they get a 50% better answer.” Matt: “There seems to be a correlation here.” The second half was about...
info_outlineCraig Peterson - Secure Your Business, Your Privacy, and Save Your Sanity
Jim came into the segment from a morning on Flock license-plate cameras, and Craig took it one step wider. The technology is old and the courts have ruled on it for years; his discomfort is with how much of our information is collected at all. Websites that must verify your age now ask for a photo of your driver’s license or passport, so Facebook “or whomever” holds government ID for millions of people. Craig said 150 million of those records have been stolen. “So now what are they going to do? How am I going to prove who I am when other people have a copy of all of my information?”...
info_outlineCraig Peterson - Secure Your Business, Your Privacy, and Save Your Sanity
OpenAI’s model got into Hugging Face. Anthropic said its model had broken into someone first. Then Google said its model had done it before either of them. Jeff wanted to know how these AIs keep “breaking out,” and whether he should picture Robby the Robot fiddling with a lock. Craig spent the previous two weeks reading the published investigations, which go back to May, and said nothing broke out of anything: “These AIs were let loose on networks that had access to the Internet. They were given specific instructions that had 100% to do with hacking and breaking into systems.” The...
info_outlineCraig Peterson - Secure Your Business, Your Privacy, and Save Your Sanity
Jeff and Heidi hold happy hour at the bar in their house at 6:03, and Heidi has decided what it is missing: a robot bartender. Jeff’s terms were that he picks how it looks and she picks what it says. Craig’s answer was that the hardware already exists. Bars now have table-top machines that check your ID card and make any drink you order; those start around $30,000, and home versions run about $400. The conversation half is ChatGPT or Claude, spoken rather than typed. It started with a more serious question. Elon Musk and Sam Altman both say AI development should slow down, so why not...
info_outlineCraig Peterson - Secure Your Business, Your Privacy, and Save Your Sanity
Craig’s wife sent him an article the morning of the show: Chinese ships moving through the straits of northern Canada are not just passing through. International agreements allow transit through territorial waters at a reasonable pace, but these ships are stopping, and it looks like they are measuring the sea floor. Russia is doing it too. The route used to be frozen; now it can be navigated in summer. Craig used it to explain why the U.S. wants a foothold in the North. It was the last stop in a long Canada conversation. Jim opened on British Columbia’s three-year experiment...
info_outlineCraig Peterson - Secure Your Business, Your Privacy, and Save Your Sanity
This was the biggest Patch Tuesday on record: Microsoft pushed close to 700 patches in a single month, roughly six times the usual volume. Craig's follow-up question is the one that actually decides whether a machine is exposed. Microsoft is patching Microsoft. Who is patching everything else? Windows Update never touches third-party software — it barely updates Windows itself, Craig said, and it does nothing for the average of 62 other programs sitting on a typical computer, many of which are being actively exploited right now. He named Adobe Reader and WinZip specifically: the current...
info_outlineCraig Peterson - Secure Your Business, Your Privacy, and Save Your Sanity
Craig grew up in Canada and left in the 1970s, and this week he put numbers on why. A driver's license in Quebec cost $300 a year. Registration on the family station wagon cost $3,000 a year. Both figures in 1970s dollars. Auto insurance, by contrast, was free — which Craig turned into the sharpest point of the segment: his father remarried, his stepmother got her license at 26, and she totaled three cars. Craig's question was not about her driving. It was about what happens to the premium. "How much does insurance go up? How much is the risk? Zero, of course, because there is no insurance....
info_outlineApple is Adding Tech to Look At Your Photos For Child Abuse
This is a tough one. Apple has decided that it will build into the next release of the iPhone and iPad operating systems, which monitors for child porn.
[Automated transcript]
Apple has now explained that they will be looking for child abuse images in specific ones. And I just am so uncomfortable talking about this, but the whole idea behind it is something we need to discuss. Apple said they're going to start scanning for these images and confirmed the plan. In fact, when people said, are you sure you're going to be doing that?
[00:00:44] Here's what. IOS 15, which is the next major release of Apple's operating system for I-phones. And for I pad is going to use a tie to something called the national center for missing and exploited children. And the idea behind this is to help stop some of this child abuse. And some people traffic in children; it's just unimaginable.
[00:01:14] What happens out there really is some people. It's just such evil. I, I just don't get it. Here's what they're going to be doing. There are ways of taking checksums of pictures and videos so that if there is a minor change in something that might occur because it was copied, it does not mess it up.
[00:01:40] It still can give the valid checksum and. Iman, that technology is detailed, but basically, just think of it as a checksum. So if you have a credit card number, there is a checksum digit on that bank accounts have checked some digits. If you mess it up a little bit, okay, it's an invalid checksum, so that number's obviously wrong in this case.
[00:02:04] What we're talking about is a checksum of a pitcher or oven. And these various child safety organizations have pictures of children who are abused or who are being abused, who are being exploited. And they have these checksums, which are also called hashes. So that is now going to be stored on your iOS device.
[00:02:34] And yes, it's going to take some space on the device. I don't think it's going to take an enormous amount of space, considering how much space is on most of our iPhones and iPads that are out there. Apple gave this detection system is called CSam, an absolute thorough technical summary. It is available online, and I've got a to this article in this week's newsletter, but they released this just this month, August of 2021.
[00:03:07] And they're saying that they're using a threshold, that is. Quote set to provide an extremely high level of accuracy and ensures the less than one in 1 trillion chance per year of incorrectly flagging a given account. So now I can say with some certainty in having had a basic look through some of the CSM detection documentation that they're probably right about that, that the odds are excellent.
[00:03:40] Small that someone that might have a picture of their kids in a bathtub, the odds are almost so close to zero. It is zero that it will be flagged as some sort of child abuse because it's not looking at the content of the picture. It's not saying that this picture maybe a picture of child exploitation or a video of her child being exploited.
[00:04:02] If it has not been seen before by the national center for missing exploited. It will not be flagged. So I don't want you guys to get worried that a picture at the beach of your little boy running around and just boxer trunks, but a lot of skin showing is going to get flagged. It's not going to happen.
[00:04:25] However, a pitcher that is known to this national center for missing and exploited children is, in fact, going to be flagged, and your account will be flagged. Now it's hard to say precisely what they're going to do. I haven't seen anything about it, of the apples. Only say. That that they're going to deploy software.
[00:04:51] That will analyze images in the messages application for a new system that will warn children and their parents from receiving or sending sexually explicit photos. So that's different. And that is where again, a child, you put parental settings on their iPhone. If they're taking these. Pictures, selfies, et cetera.
[00:05:14] Girls sending it to a boyfriend, sending it to his girlfriend, whatever it might be. The parents will be warned, as are the children looking for things that might be of sexual content. Okay. It really is. It's really concerning. Now let's move on to the part that I'm concerned about. I think everyone can agree that both of those features are something good that will ultimately be very good, but here's a quote.
[00:05:41] Apple is replacing its industry-standard end-to-end encrypted messaging system with an infrastructure for surveillance and censorship. Now, I should say this guy who's co-director for the center for democracy and technology security and surveillance product project. He's Greg, no, him, no Chaim, is saying this. He said Apple should abandon these changes and restore its users, faith in the security and integrity of apple devices and services.
[00:06:15] And this is from an article over a tech. So this is now where we're getting. Because what are they doing? How far are they going? Are they going to break the end encryption in something like I messages? I don't think they are going to break it there. So they're not setting up, necessarily, an infrastructure for surveillance and censorship. But, still, Apple has been called on, as has every other manufacturer of the software.
[00:06:45] I remember during the Clinton administration, this whole thing with eclipse. The federal government was going to require anyone who had any sort of security to use this chip developed by the federal government. And it turns out, of course, the NSA had a huge backdoor in it, and it was a real problem.
[00:07:04] Look at Jupiter. That was another encryption chip, and it was being used by Saddam Hussein and his family to communicate. And it turns out, yeah, there's a back door there too. This was a British project and chip that was being used. So with apple, having resisted pressure. To break into phones by the US government.
[00:07:28] But some of these other governments worldwide that have been very nasty have been spying on their citizens who torture people who don't do what apple are not happy, what the government wants them to do been trying to pressure Apple into revealing this. So now I have to say, I have been very disappointed in all of these major companies, including Apple. When it comes to China, they're just drooling at the opportunity to be there.
[00:07:57] Apple does sell stuff there. All of these companies do. Yeah, Google moves their artificial intelligence lab to China, which just, I cannot believe they would do something like that. AI machine learning, those or technologies that will give the United States a real leg up technology-wise to our competitors worldwide.
[00:08:18] They move to China, but they have complied with this great firewall of China thing where the Chinese people are being censored. They're being monitored. What's going to happen now because they've had pressure from these governments worldwide to install back doors in the encryption systems.
[00:08:39] And apple said, no, we can't do that because that's going to undermine the security for all users, which is absolutely true. For example, if there is a door with a lock, eventually, that lock will get picked. And in this case, if there's a key, if there's a backdoor of some sort, the bad guys are going to fight. So now Apple has been praised by security experts for saying, Hey, listen, we don't want to undermine security for everybody, but this plan to do ploy, some software that uses the capabilities of your iPhone to scan.
[00:09:16] Your pictures, your photos, videos that you're sharing with other people and sharing selected results with the authorities. Apple is really close to coming across that line to going across it. Apple is dangerously close to acting as a tool for government surveillance. And that's what John Hopkins university cryptography professor Matthew Greene said.
[00:09:47] This is really a key ingredient to adding surveillance to encrypted messages. This is again, according to our professor over John Hopkins, green professor green, he's saying that would be a key in Greece and then adding surveillance, encrypted messaging, the ability to add scanning systems like this to end encrypted messaging systems has been a major ask by law enforcement, the world.
[00:10:15] So they have it for detecting stuff about missing and exploited children. That's totally wonderful. And I'm okay with that. No problem. But that now means that Apple's platform can add other types of scanning. All right. We'll see what ends up happening next, which is warning children and their parents about sexually explicit photos is also a bit of a problem here.
[00:10:47] Apples. Yeah, on this is messages uses on-device machine learning to analyze image attachments and determine if a photo is sexually explicit. The feature is designed so that Apple does not get access to the messages it's saying. If it detects it, they're going to blur the photo. The child will be warned, presented with helpful resources, and reassured it is okay if they do not want to view them.
[00:11:17] And the system will let parents get a message. If children view a flagged photo, similar protections are available for child attempts to send sexually explicit images. Interesting. Isn't it. Interesting world. So I think what they're doing now is, okay, they're really close to that line, going over.
[00:11:39] It could mean the loss of lives in many countries that totally abuse their citizens or subjects, depending on how they look at them. Hey, make sure you check me out online. Craig Peterson.com.