Security News > 2021 > October > Client-side content scanning as an unworkable, insecure disaster for democracy

CSS in theory provides a way to look for unlawful content while also allowing data to be protected off-device.

"Indeed, the effect is the opposite. CSS by its nature creates serious security and privacy risks for all society while the assistance it can provide for law enforcement is at best problematic. There are multiple ways in which client-side scanning can fail, can be evaded, and can be abused."

Apple's system figures prominently in the analysis but concern about potential deployment of CSS goes beyond a single company and a single type of troubling content, CSAM. As the paper observes, the EU has suggested that content related to terrorism and organized crime, in addition to CSAM, should be targetable by CSS. Moreover, the issue is not just illegal content.

Apple has attempted to address with the possibility that repressive regimes might try to co-opt its system to scan for politically unacceptable content by insisting that it will scan only for content hashes present in lists maintained by multiple child safety organizations.

CSS faces challenges adhering to policy principles like those that prohibit bulk surveillance without a warrant in the US and the EU. Then there's the question of whether a CSS system could operate equitably.

CSS, the paper says, entails privacy risks in the form of "Upgrades" that expand what content can be scanned and adversarial misuse.

News URL

https://go.theregister.com/feed/www.theregister.com/2021/10/15/clientside_side_scanning/