The ‘non-profit start-up’ Thorn, founded by actor Ashton Kutcher, is a driving force behind the EU’s campaign to scan the net for child abuse material. Newly public documents and financial information obtained by Follow the Money reveal the blurred boundaries between Thorn’s do-good public face and the powerful business behind it.

How Ashton Kutcher’s ‘non-profit start-up’ makes millions from the EU’s fight against child abuse on the net::The ‘non-profit start-up’ Thorn, founded by actor Ashton Kutcher, is a driving force behind the EU’s campaign to scan the net for child abuse material. Newly public documents and financial information obtained by Follow the Money reveal the blurred boundaries between Thorn’s do-good public face and the powerful business behind it.

  • Bernie EcclestonedEnglish
    26•1 year ago

    Safer, Thorn’s flagship software product, was launched in 2018. Backed by Microsoft’s PhotoDNA technology and with technical support from Amazon Web Services, Safer is designed to detect child abuse by matching hash values of pictures or videos uploaded by users with a database of millions of known CSAM images.

    I don’t really understand how this works. Are the hash values like meta data? Is there a way to maintain privacy but also check for illegal material?

    • @[email protected]English
      29•1 year ago

      Hashing, at its simplest, is turning an arbitrarily large chunk of data into a single hopefully unique value.

      For example, if I wanted to hash a 4-letter word, the simple version would be as such:

      ` H A S H

      ` 8 1 19 8

      If we take the numeric value of each, we can add those together and get 36. If the number gets too high, there would be a clamping mechanism to keep it manageable. For our simplistic example, we could chop off any hundreds place digits or higher. Now if I were to hash a different four-letter word, the odds of it having the same hash value (known as a “collision”) are low. Thus if you tell me you sent me a message with a hash of 36, I can look at the message you sent, calculate the hash, and confirm that it’s the same message you intended to send with a certain degree of confidence.

      Now modern hashing is vastly more complicated (https://en.m.wikipedia.org/wiki/MD5), but the gist is the same. Take the data in a file, jam it all together through an algorithm to come up with a hash value, then use that to find equivalent files.

      The problem here is that if it’s a classic data validation hash algorithm, changing just a single bit can change the entire hash, which would foil an identification system. So hopefully this system actually hashes images based on some kind of relative semantic information within the photo, such as color distributions and features so even if you crop or adjust the image slightly the hash still matches.

    • @[email protected]English
      11•1 year ago

      It sounds like they have a database of CSAM images, so they’re likely hashing parts of the suspected image or video and searching for that hash in the database

      • Bernie EcclestonedEnglish
        7•1 year ago

        Right, so I guess the software is doing that prior to it being encrypted and sent.

        Is the problem that it could do more than just scan for CSAM, ie. Anything that the government, or dictator, decides?

        • @[email protected]English
          6•1 year ago

          That’s exactly the risk. There’s no way to implement this type of client side scanning without building infrastructure that can then also be used to scan for other things.

      • P03 LockeEnglish
        1•1 year ago

        This isn’t like an anti-virus system. You can’t just catalog them all. It’s too easy to create. Hell, with the advent of LLMs and AI-generated images, it’s going to be even easier to create.

        • @[email protected]English
          2•1 year ago

          Too easy to create and too easy to foil the hash, unless it’s some kind of highly sophisticated feature-based hashing.