How Ashton Kutcher’s ‘non-profit start-up’ makes millions from the EU’s fight against child abuse on the net::The ‘non-profit start-up’ Thorn, founded by actor Ashton Kutcher, is a driving force behind the EU’s campaign to scan the net for child abuse material. Newly public documents and financial information obtained by Follow the Money reveal the blurred boundaries between Thorn’s do-good public face and the powerful business behind it.
I don’t really understand how this works. Are the hash values like meta data? Is there a way to maintain privacy but also check for illegal material?
Hashing, at its simplest, is turning an arbitrarily large chunk of data into a single hopefully unique value.
For example, if I wanted to hash a 4-letter word, the simple version would be as such:
` H A S H
` 8 1 19 8
If we take the numeric value of each, we can add those together and get 36. If the number gets too high, there would be a clamping mechanism to keep it manageable. For our simplistic example, we could chop off any hundreds place digits or higher. Now if I were to hash a different four-letter word, the odds of it having the same hash value (known as a “collision”) are low. Thus if you tell me you sent me a message with a hash of 36, I can look at the message you sent, calculate the hash, and confirm that it’s the same message you intended to send with a certain degree of confidence.
Now modern hashing is vastly more complicated (https://en.m.wikipedia.org/wiki/MD5), but the gist is the same. Take the data in a file, jam it all together through an algorithm to come up with a hash value, then use that to find equivalent files.
The problem here is that if it’s a classic data validation hash algorithm, changing just a single bit can change the entire hash, which would foil an identification system. So hopefully this system actually hashes images based on some kind of relative semantic information within the photo, such as color distributions and features so even if you crop or adjust the image slightly the hash still matches.
Thanks!
It sounds like they have a database of CSAM images, so they’re likely hashing parts of the suspected image or video and searching for that hash in the database
Right, so I guess the software is doing that prior to it being encrypted and sent.
Is the problem that it could do more than just scan for CSAM, ie. Anything that the government, or dictator, decides?
That’s exactly the risk. There’s no way to implement this type of client side scanning without building infrastructure that can then also be used to scan for other things.
Got it. Thanks!
This isn’t like an anti-virus system. You can’t just catalog them all. It’s too easy to create. Hell, with the advent of LLMs and AI-generated images, it’s going to be even easier to create.
Too easy to create and too easy to foil the hash, unless it’s some kind of highly sophisticated feature-based hashing.
This one breaks the images in their database into blocks, hashes those blocks separately, then checks your images by matching those hashes against same sized block hashes. It needs only a certain number to claim a positive match, and in theory it should be manually checked.
However pedos tend to have 10000s of images and they aren’t going to all be manually checked so the process is going to be trusted rather than proven for each case. This is risky as it’s only matching some blocks rather than all the blocks for the whole image and can be defeated by simple filters or changing enough of the blocks to make the test meaningless.