How Ashton Kutcher’s ‘non-profit start-up’ makes millions from the EU’s fight against child abuse on the net::The ‘non-profit start-up’ Thorn, founded by actor Ashton Kutcher, is a driving force behind the EU’s campaign to scan the net for child abuse material. Newly public documents and financial information obtained by Follow the Money reveal the blurred boundaries between Thorn’s do-good public face and the powerful business behind it.

  • Bernie Ecclestoned
    link
    fedilink
    English
    261 year ago

    Safer, Thorn’s flagship software product, was launched in 2018. Backed by Microsoft’s PhotoDNA technology and with technical support from Amazon Web Services, Safer is designed to detect child abuse by matching hash values of pictures or videos uploaded by users with a database of millions of known CSAM images.

    I don’t really understand how this works. Are the hash values like meta data? Is there a way to maintain privacy but also check for illegal material?

    • @EvilBit
      link
      English
      29
      edit-2
      1 year ago

      Hashing, at its simplest, is turning an arbitrarily large chunk of data into a single hopefully unique value.

      For example, if I wanted to hash a 4-letter word, the simple version would be as such:

      ` H A S H

      ` 8 1 19 8

      If we take the numeric value of each, we can add those together and get 36. If the number gets too high, there would be a clamping mechanism to keep it manageable. For our simplistic example, we could chop off any hundreds place digits or higher. Now if I were to hash a different four-letter word, the odds of it having the same hash value (known as a “collision”) are low. Thus if you tell me you sent me a message with a hash of 36, I can look at the message you sent, calculate the hash, and confirm that it’s the same message you intended to send with a certain degree of confidence.

      Now modern hashing is vastly more complicated (https://en.m.wikipedia.org/wiki/MD5), but the gist is the same. Take the data in a file, jam it all together through an algorithm to come up with a hash value, then use that to find equivalent files.

      The problem here is that if it’s a classic data validation hash algorithm, changing just a single bit can change the entire hash, which would foil an identification system. So hopefully this system actually hashes images based on some kind of relative semantic information within the photo, such as color distributions and features so even if you crop or adjust the image slightly the hash still matches.

    • @Ledivin
      link
      English
      111 year ago

      It sounds like they have a database of CSAM images, so they’re likely hashing parts of the suspected image or video and searching for that hash in the database

      • Bernie Ecclestoned
        link
        fedilink
        English
        81 year ago

        Right, so I guess the software is doing that prior to it being encrypted and sent.

        Is the problem that it could do more than just scan for CSAM, ie. Anything that the government, or dictator, decides?

        • @ultranaut
          link
          English
          71 year ago

          That’s exactly the risk. There’s no way to implement this type of client side scanning without building infrastructure that can then also be used to scan for other things.

      • P03 Locke
        link
        fedilink
        English
        11 year ago

        This isn’t like an anti-virus system. You can’t just catalog them all. It’s too easy to create. Hell, with the advent of LLMs and AI-generated images, it’s going to be even easier to create.

        • @EvilBit
          link
          English
          21 year ago

          Too easy to create and too easy to foil the hash, unless it’s some kind of highly sophisticated feature-based hashing.

    • @tankplanker
      link
      English
      41 year ago

      This one breaks the images in their database into blocks, hashes those blocks separately, then checks your images by matching those hashes against same sized block hashes. It needs only a certain number to claim a positive match, and in theory it should be manually checked.

      However pedos tend to have 10000s of images and they aren’t going to all be manually checked so the process is going to be trusted rather than proven for each case. This is risky as it’s only matching some blocks rather than all the blocks for the whole image and can be defeated by simple filters or changing enough of the blocks to make the test meaningless.