If you compare it against the industry standard of in-cloud scanning, the privacy comes from the fact that an on-device model results in 0 Apple servers ever examining your photos (unless you have 30 CSAM flags on your iCloud account), whereas an on-server model results in Apple servers examining every single photo you upload.
You can argue it's better to have neither type of scanning, but if Apple considers it a critical business issue that their cloud is the preferred hosting site of CSAM[0], then they presumably have to pick one or the other.
You can also argue that on-device seems creepier or more invasive, even if it doesn't result in Apple examining your photos, which is a reasonable reaction. It certainly breaks the illusion that it's "your" device.
But it's a fact that the on-device model, as described, results in less prying eyes on your iCloud photos than the on-server model.
[0] I'm not claiming this is the case, just saying for example
> the privacy comes from the fact that an on-device model results in 0 Apple servers ever examining your photos (unless you have 30 CSAM flags on your iCloud account), whereas an on-server model results in Apple servers examining every single photo you upload.
Every single photo you upload is getting scanned -- it's just that Apple is doing the scanning on "your" device instead of their servers.
From the point of view of the privacy of your photos, I fail to see what the difference between the two is. I mean, if they did the exact same type of scanning on their servers instead of your device, the level of privacy would be identical.
In terms of general privacy risks, not to mention the concept that you own your devices, there is an enormous difference between the two, and on-device scanning is worse.
> From the point of view of the privacy of your photos, I fail to see what the difference between the two is.
Good point. The question is privacy "from whom". For me, privacy "from apple" means mostly from malicious individuals working for Apple (indeed, if you have an iPhone running proprietary Apple software, you could never truly have privacy from Apple the corporation).
There are documented cases of employees at various cloud services[0] using their positions of power to spy on users of said services. Performing on-server scanning implies that servers regularly decrypt users' encrypted data as a routine course (or worse, never encrypt it in the first place), which provides additional attack vectors for such rogue employees.
On the other hand, taking the on-device scanning as described, the on-device scanning process couldn't be possibly used as an attack vector by a rogue employee, since Apple employees do not physically control your device. Maybe an attack vector here involves changing the code and pushing a malicious build, which is a monumentally difficult task (and already an attack vector today).
For me, privacy means that I have control over who I disclose what to. But context matters. If I'm in my own house, I (should) have almost total control over disclosure. When I'm in someone else's house, I have very little control as I'm subjecting myself to their rules.
A smartphone is probably the most intimate, personal device most people will ever own, and it's the equivalent of their house. However, if you're using cloud services, then you're in someone else's house and are subject to their rules.
That's why, in my view, doing the scanning on-device is not only dangerous, but unethical. Doing the scanning on the servers is neither of those things.
I get the argument about rogue employees, but I don't find it persuasive. I'm told that Apple keeps your data encrypted on their servers, although they hold the keys. If that's so, then "rogue employees" are something that Apple can, and should, control.
None of this is an increase in security or privacy. What you described is merely a mitigation of a massive loss in security and privacy, when compared to other massive losses in security and privacy.
> What you described is merely a mitigation of a massive loss in security and privacy
If we're looking at the end result, a mitigation of a loss of privacy is an increase in privacy compared to the alternative, no?
I mean clearly what you're saying here is "scanning always bad!". I understand that, I really do. I'm saying that scanning was never not on the table for a large corporation hosting photos on their server. Apple held out on the in-cloud scanning because they wanted a "better" scanning, and GP's point is that it's ironic that the one cloud provider willing to try to make a "less bad" scanning option is the one most demonized in the media.
None of this is to argue that scanning is anything less than a loss in security and privacy. Yes, yes, E2EE running on free and open source software that I personally can recompile from source would be the best option.
> GP's point is that it's ironic that the one cloud provider willing to try to make a "less bad" scanning option is the one most demonized in the media.
I think that may be because it's far from clear that Apple's solution is "less bad".
> If we're looking at the end result, a mitigation of a loss of privacy is an increase in privacy compared to the alternative, no?
I guess you could say that in the same way that you can say that a gambler who just won $10 is "winning", even though their bank account is down $100,000. It only works if you completely lose all perspective.
