It works like this. A national charity - in the United States, this is the National Center for Missing and Exploited Children, or NCMEC, while in the UK it’s the Internet Watch Foundation - maintains a known database of horrific child abuse images. These images are given a mathematical signature, a kind of fingerprint called a “hash”, and services then look for that signature. If a match is found, NCMEC is alerted.

Google began scanning your emails for the fingerprints in 2008 and Facebook followed suit, for uploads, in 2011. The latter filed 17 million reports to NCMEC in 2018 - a grim statistic.

Online storage service Dropbox also scans for hashes. Apple has been scanning iCloud emails for years, but not iCloud photos.

The saga illustrates the tightrope that Apple walks, between user trust and legal obligations, and many more battles lie ahead.

The implementation is both complex and ingenious. Apple has created multi-layered shells of encryption to reassure users that it isn’t snooping, meaning that the detection takes place without “seeing” anything else on your iPhone. Contrast this with the apps you already use today on your smartphone, which trawl through every directory and which can even monitor how much time you’re spending in other apps.

Apple will only make a report to NCMEC once a threshold of positives has been received, and after Apple staff have performed a manual check. Apple says this is bad news for paedophiles with large collections of abuse images but won’t affect anyone else at all.

The saga illustrates the tightrope that Apple walks, between user trust and legal obligations, and many more battles lie ahead. Apple maintains its own key to unlock your iPhone back-ups on the production of a court order. Apple has refused to produce a “backdoor” way of accessing the phone itself, where no back-ups have been made, but law enforcement agencies use shady tools developed by hackers to find a way around this.

Loading

So, why do critics say the sky is falling in? I’ll offer two thoughts.

Specifically, this highlights a confusion about boundaries. We view a device such as an iPhone as our own - but when we use Dropbox, or Gmail, or Apple’s iCloud Photo, we’re storing material on their servers. Apple’s critics insist that a private space is being invaded, but it’s a strange claim: a distinction without a difference.

As one of the few pundits to read the details, veteran Apple-watcher Charles Arthur points out: “At the airport, whether you’re frisked at the gate or before, either way you’re scanned. And we’ve been scanned for years.”

But more generally, a good privacy scare is good for business in the ever-burgeoning Privacy Priesthood that now sprawls across academia, quangos and the NGO sector. Every initiative is a “slippery slope”. The incentive structure of attention rewards Chicken Littles who warn the sky is falling - but no reputational reward accrues to those who deflate exaggerations or scaremongering, let alone those who try to engage and build something useful.

And, ominously, policymakers are beginning to conclude that privacy experts are a constituency they’ll never please. So why bother?

The Daily Telegraph

The Business Briefing newsletter delivers major stories, exclusive coverage and expert opinion. Sign up to get it every weekday morning.