Re: Approaching the IETF - A View from Civil Society

[John Curran <[e-mail]>]

> On Aug 2, 2023, at 8:52 PM, Christian Huitema <[e-mail]> wrote:
> On 8/2/2023 4:53 PM, John Levine wrote:
>> It appears that Keith Moore  <[e-mail]> said
>>> Everyone needs to understand that a likely effect of any CSAM
>>> countermeasure is to increase the distribution and production of CSAM,
>>> and with it the number of victims.
>> Um, what?
> 
> That's the general tit-for-tat between offense and defense. We have seen it with spam: better spam detection begets smarter hiding of spam, and vice versa. The same is very likely to happen with CSAM. If a CSAM scanning technology is applied at control points, the criminals who profit from distributing this material would probably find some way to tweak their materials and evade that particular technology, which will evolve, etc. It will not stop if only a fraction of the criminals and their audience are caught, because there will always remain a substantial fraction in the wild to evolve their methods.

Christian - 

On the surface, it would appear that particular argument (countermeasures have to be highly effective or else they simply encourage evolution and thus become ineffective over time) could be applied equally well to a large range of security measures – including many that are widely deployed today such as home and automobile locks, network intrusion monitoring, passwords on computer accounts, etc.   Somehow we’ve determined that these measures remain useful, despite their imperfect nature and the continuous state of attack/defense evolution. 

Now one can argue that real world security analogies don’t apply, because in the real world there is often the prosecution of culprits – unlike occurs with those caught in spam filters – but I would note that there is rather significant prosecution efforts (and successes) today against CSAM production and distribution, so that comparison to spam detection really doesn’t hold up – even modestly functional measures that mitigate a small additional fraction of the activity would make a real very difference to those who don’t have to suffer the harms of trafficking & production. 

Perhaps I misunderstood, and there’s a more coherent formulation of why countermeasures are likely to "to increase the distribution and production of CSAM and with it the number of victims” – if so, can you elaborate?

Thanks,
/John

p.s. disclaimers(s):  my views alone. shock hazard – no user serviceable parts inside.