Craig Federighi says introducing two similar features at the same time, iMessage protections for children and CSAM scanning of iCloud photos, caused confusion

Facing criticism about eroding privacy on the iPhone, Apple's Craig Federighi says new tools aimed at best ensuring privacy while fighting illegal images

Wall Street Journal 2021-08-14

Context & Ripple Effects

Apple had already acknowledged internal concern about its photo-scanning proposal in a memo defending the need to protect children, while outside criticism argued that the broader child-safety announcement had damaged the policy balance around encrypted communications. Federighi’s explanation reframes the episode as a rollout and messaging problem spanning two distinct Apple services, rather than a single privacy-policy change.

First-order effects

Apple must separately explain its iMessage child protections and iCloud photo-scanning proposal to users and privacy critics, because presenting them together blurred their differing scopes.
The privacy debate around Apple’s child-safety effort remains centered on iCloud scanning, even as Federighi distinguishes it from protections in iMessage.

Second-order effects

The combined announcement gives critics a stronger basis to connect cloud-photo scanning with Apple’s wider approach to protected communications, echoing the earlier warning that the announcement harmed the safety-versus-privacy balance.
Apple’s product and communications teams face pressure to treat safety features in iCloud and iMessage as separate trust decisions rather than as one bundled initiative.

Third-order effects

If Apple continues to introduce safety controls across private services, the boundary between on-device messaging protections and cloud-account scanning will become a central test of whether users accept those controls.
The episode points toward child-safety policy being judged not only by its stated goal but by where in a service Apple applies it and how clearly it distinguishes that implementation.

The trend: Consumer-platform safety programs are increasingly shaped by whether companies can separate protections across encrypted, device, and cloud layers without eroding privacy trust.

Discussion

@runasand Runa Sandvik on x
Apple's left hand doesn't know what its right hand is doing. First it sued @CorelliumHQ for enabling people to inspect iOS devices. Now it's saying those same people will be able to spot if the photo matching process is misused in some way. https://twitter.com/...
@alecmuffett Alec Muffett on x
“Apple software head [#CraigFederighi] says plan to scan iPhones for child abuse images is ‘misunderstood’” Craig, I really don't think that *that* is the problem here. The problem is that Apple unwisely & illiberally over-reached into people's privacy. https://www.cnet.com/...
@evacide Eva on x
I'd like to take this moment to make it clear to poor Craig that no, I don't misunderstand Apple's plans to check photos in iCloud against NCMEC's database of CSAM. It's well-meaning but it's also creating a mechanism that Apple will be forced to use for other things. https://twi…
@bobmcmillan Robert McMillan on x
Apple's Craig Federighi says the iPhone's CSAM threshold will be about 30 images and that on-phone database will ship internationally, but engages in magical thinking about whether Apple is scanning images on your phone. https://www.wsj.com/...
@joannastern Joanna Stern on x
I sat down with Apple's Craig Federighi to talk about the company's child protection features. He spoke about the stumbles the company made in the announcement. I pushed him to explain everything in plain english. Here's the exclusive video interview: https://www.wsj.com/...
@alexstamos Alex Stamos on x
@runasand Yes, and making a full-throated argument for these changes would require Apple to admit that there was a human impact to being 15 years behind the rest of the industry in child safety.
@keleftheriou Kosta Eleftheriou on x
Wait, so Apple wanted to ensure that the Child Sexual Abuse Material (CSAM) tech is understood to be totally separate from the iMessage photo scanning feature, and yet they're calling it “Communication, Safety, And Messages”? 🥴👏 https://twitter.com/...
@lapcatsoftware Jeff Johnson on x
The day after settling a copyright lawsuit against security researchers: “Apple has always been at peace with security researchers.” https://twitter.com/...
@ihnatko Andy Ihnatko on x
@siegel I'm not even kidding here: Apple screwed up the messaging on this so completely that I wonder if a certain key person or two is on an extended vacation or personal leave and wasn't around to oversee this. Apple jumped on a rake with both feet, from the top of a ladder.
@lorenzofb Lorenzo Franceschi-Bicchierai on x
Apple's rollout of its CSAM scanning tool has been just a huge PR mess. Company failed to explain exactly how this works, which users it affects, what data it touches, etc. And then...Apple has been going around complaining public and press “misunderstood” everything.
@runasand Runa Sandvik on x
@alexstamos Anyone who's ever tried to announce changes to the office desk layout, the menu in the cafeteria, or the types of snacks by the coffee machine know that humans do not like surprises.
@timsweeneyepic Tim Sweeney on x
Governments want this search capability but many, including America, are constitutionally prohibited from it. Perhaps Apple thinks that if they give governments this massive surveillance gift at this critical time, regulators will look the other way on their antitrust abuses.
@hatr Hakan on x
“Because it's on the [phone], security researchers are constantly able to introspect what's happening in Apple's [phone] software,” (11-min interview w/ Apple's software chief Craig Federighi) https://www.wsj.com/...
@josephfcox Joseph Cox on x
Apple says possible for security researchers to verify how its CSAM system works because it's being done on the device. Apple does not have the best reputation for making research easy, at all. If anything, tries to block it. https://www.wsj.com/... https://twitter.com/...
@madbitcoins Mad Bitcoins on x
It's strange that 30 or so is the magic number of unacceptable “known bad signature” child porn images. I suppose there must be a threshold somewhere. Again the key is it's matching a known database of bad sigs, not scanning images for new ones. https://www.wsj.com/... https://tw…
@benedictevans Benedict Evans on x
Seriously, the whole point of the iOS security model is that this is supposed to be impossible for third parties. You can't just snoop around inside the OS watching what's going on - that's how malware works.
@timsweeneyepic Tim Sweeney on x
My fear is that what Apple is ultimately trying to backdoor here is not our iPhones but democracy and rule of law itself.
@timsweeneyepic Tim Sweeney on x
Apple already made such a deal in China, selling out the privacy of iCloud users there by putting iCloud servers in a data center operated by a government owned enterprise. Now Americans are told “trust us” because, though we just sold you out now, we won't do it again.
@alexstamos Alex Stamos on x
@benedictevans Right, until three days ago Apple was arguing that DMCA 1201 should outlaw pretty much any reverse engineering tool that could be used for security research.
@benedictevans Benedict Evans on x
@alexstamos Their neat little ‘on-device=private, off-device=not private’ theory has led them right into a corner.
@kaepora @kaepora on x
I'm sorry, but what the hell is Craig Federighi talking about here?! Since when are security researchers “constantly able to introspect what's happening in iOS”?!?! iOS is the blackest of black boxes, that's the point researchers have been making since last week! It's opaque! htt…
@mgsiegler M.G. Siegler on x
Few days later, it's even more clear that first and foremost this was the mother of all communications fuck-ups from Apple. And they have strong competition from players like the CDC and, as always, Facebook. What on Earth was Apple thinking rolling this out with this strategy?! …
@benedictevans Benedict Evans on x
Wouldn't Apple sue you if you did that? https://twitter.com/...
@alexstamos Alex Stamos on x
30 images is a higher bar than I expected, and indicates that Apple's goal is more to prevent mass sharing of known CSAM instead of tracking down the original creators of CSAM found elsewhere. Then why apply to all of the photo roll and not just shared albums? https://twitter.com…
@alexstamos Alex Stamos on x
Federighi is right about the confusion caused by bundling the iMessage and iPhoto protections into one announcement, but the bigger PR mistep was: 1) Not being clear about the goals 2) Not announcing the parallel roadmap for iCloud encryption
@gsterling Greg Sterling on x
Apple somewhat naively assumed its privacy reputation would shield it against criticism of CSAM on-device scanning. https://www.wsj.com/...
@adrianweckler Adrian Weckler on x
More clarity: Apple's child abuse image scanning system will only trigger alert when “around 30” images are detected. Great explainer (and interview) here. https://twitter.com/...
@dsilverman Dwight Silverman on x
Facing criticism about privacy on the iPhone, Apple's Craig Federighi says new tools aimed at best ensuring privacy while fighting illegal images https://www.wsj.com/... via @WSJ I appreciate that there's a text version of this story as well as video.
@lanceulanoff Lance Ulanoff on x
Exactly: “In hindsight, introducing these two features at the same time was a recipe for this kind of confusion.” https://www.wsj.com/...
@charlesarthur Charles Arthur on x
Ah, so “about 30” is the magic number for tripping Apple's CSAM system. Wonder how they arrived at that number. https://www.wsj.com/... https://twitter.com/...
@charlesarthur Charles Arthur on x
Re Apple's CSAM scanning, @kesenwang points out that Apple updated its privacy policy in late May 2019 to allow scanning for CSAM. Apple's been working on this for years. @josephmenn @benthompson @gruber https://web.archive.org/... v https://web.archive.org/... (tip @techmeme) ht…
@timkhiggins Tim Higgins on x
Apple's Craig Federighi discusses how new tool to combat child porn is designed with safeguards, such as independent audits, to protect user privacy, w/ ⁦@JoannaStern⁩ https://www.wsj.com/...
@huntressofcrete Artemis on x
Apple is flagging ICloud photos that match known pedo databases. It's not one photo, but a threshold of multiple photos uploaded that triggers an alert. Pretty sure Apple has no interest in aggravating a huge customer base through algorithmic mistakes. https://www.wsj.com/...
@joannastern Joanna Stern on x
@johnmisczak @reckless He went into a bit more on it and we detail that in the news story here and in the column I have coming soon https://www.wsj.com/... https://twitter.com/...
@reckless Nilay Patel on x
One thing I'd note here is that Federighi says there are multiple points of auditability in the system and... it would be good if those were clearly spelled out and people were able to audit them
@reckless Nilay Patel on x
Here's ⁦@JoannaStern⁩ with Apple's Craig Federighi on the child protection system and how it works https://www.wsj.com/...
@carlquintanilla Carl Quintanilla on x
“It's really clear a lot of messages got jumbled pretty badly in terms of how things were understood,” Mr. Federighi said. “We wish that this would've come out a little more clearly for everyone ..” ⁦@WSJ⁩ $AAPL https://www.wsj.com/...
@reneritchie Rene Ritchie on x
Where @JoannaStern does one of her always phenomenal interviews/videos — this time digging into Apple's new Child Safety features with Apple's head of software engineering https://twitter.com/...
@kaepora @kaepora on x
The sheer volume of the doublespeak Apple has done on this is nuts. Over and over again this past week, Apple issues “clarifications” where they deny something they've said and then *immediately rephrase the same claim in a new way.* Interview is here: https://www.wsj.com/...
@kaepora @kaepora on x
Craig Federighi today to the @WSJ: “We're not looking for CSAM on iPhones. [...] The sound-bite that got out early was “Apple is scanning my phone for images.” This is not what's happening” Dude, this is just blatant lying. This is directly contradicted by Apple's own statement. …
@kenroth Kenneth Roth on x
Apple says it will scan your iPhones only for evidence of child sexual abuse, but it is dangerously opening a new path for surveillance that could be used for anything. For example, @Apple has a long history of bowing to China when deemed necessary. https://www.nytimes.com/... ht…
@darchmare Jeff on x
Reuters: “Apple's child protection features spark concern within its own ranks -sources” Looks like the “screeching voices of the minority” include those within Apple itself. Good. https://www.reuters.com/...
@snowden Edward Snowden on x
@RichFelker @Apple Apple is not doing this as part of a crusade to protect children, or they would not allow it the scans to be bypassed by disabling iCloud Photos. They are doing it to be seen to be doing something while minimizing their involvement. This hurt users and doesn't …
@matthew_d_green Matthew Green on x
Here's an op-ed @alexstamos and I co-authored about the risks of Apple's content scanning plan. It's short and easy to read, and I'm hoping it makes the issues digestible to non-technical people. https://www.nytimes.com/...
@reuters @reuters on x
Exclusive: Some Apple employees are speaking out internally about the company's plan to scan iPhones and computers for child sex abuse images. Apple's move has also provoked protests from tech policy groups https://www.reuters.com/... https://twitter.com/...
@kurtopsahl Kurt Opsahl on x
“Apple employees have flooded an Apple internal Slack channel with more than 800 messages on the plan ... Many expressed worries that the feature could be exploited by repressive governments looking to find other material for censorship or arrests...” https://www.reuters.com/...

Chronicles