Like David, I don’t think cybersecurity and ‘crypto-technologists’ should be considered non-technical.

I think Torsten’s suggestion for the last sentence of para.3 is a good one. Ross Anderson’s “chat control” paper made a convincing case that domestic violence and sexual abuse are closely linked, and that preventive measures which ignore one in favour of the other are less likely to be effective.

New technology-open proposal for the first sentence of the paragraph, as there was no explicit request in the workshop to exclude CCS:

To detect CSAM online, only techniques that can protect privacy by not learning anything about the content of a message other than whether an image matches known illegal content should be used.

The new proposal paragraph 2 ws 1b by Torsten Krause is an oxymoron: Client-Side-Scanning and Privacy cannot simply not coexist.

Proposal:
Client-side scanning should not be used as a means to detect CSAM online. Instead, only techniques that can protect privacy should be used. Concerns are raised about anti-grooming techniques that analyse visual and textual data. The use of AI raises questions about proxies, bias and accuracy. Effective task-based models that respect privacy require comprehensive and accurate data, especially the use of metadata. Authorities play a critical role in double-checking the effectiveness of these measures and privacy compliance. Looking ahead, data-saving and anonymity-preserving age verification mechanisms could be a future-proof solution for robust verification and privacy protection.

Taking into account the previous comments, could it be rephrased by:
3.    Diversity and Multi-Stakeholder Philosophy: A diversified multi-stakeholder approach is required to ensure that solutions are comprehensive in addressing harmful online content. Significant weight should be given to civil society, including individuals from the vulnerable groups, like minors, and non-technical backgrounds, should be involved in this process and their perspectives taken into account.

Here is an attempt to summarise the ongoing discourse in a common message. Regardless, we should be careful to reflect the discussion of the workshop and not continue the discourse.

New proposal paragraph 2 ws 1b:

If client-side scanning is used to detect known CSAM online, only techniques that can protect privacy by not learning anything about the content of a message other than whether an image matches known illegal content should be used. Concerns are raised about anti-grooming techniques that analyse visual and textual data. The use of AI raises questions about proxies, bias and accuracy. Effective task-based models that respect privacy require comprehensive and accurate data, especially the use of metadata. Authorities play a critical role in double-checking the effectiveness of these measures and privacy compliance. Looking ahead, data-saving and anonymity-preserving age verification mechanisms could be a future-proof solution for robust verification and privacy protection.

Taking into account the previous comments, could it be rephrase by:
Privacy-Respectful, Inclusive, and Accessible Technical Approaches: 
Client-side scanning for detecting known CSAM online involves methods that can be privacy-preserving, learning nothing about the content of a message except whether an image matches known illegal content; concerns are raised about anti-grooming techniques analysing visual and textual data.
AI deployment involves issues of proxies, biases, and accuracy, necessitating inclusive and accurate data for effective task-oriented models that respect privacy, especially leveraging metadata. Authorities play a crucial role in double-checking these measures’ effectiveness and privacy compliance. Looking ahead, data-saving and anonymity-preserving age verification mechanisms could be a future-proof solution for robust verification and privacy protection.

Leave a comment on paragraph 2

·       Type of content: Child Sexual Abuse (CSAM) was mentioned; self-generated abuse material that can be voluntarily produced, shared and misused or due to coercion by online organizer groups (sextortion), both with severe consequences as suicidal actions; Pathological content (live broadcasting content appealing to violence, alcohol consumption, sexual abuse, etc).

It was an attempt not only to react, but also to reflect on other thoughts and suggest a possible solution. In view of your response, I suggest formulating it as follows. By the way, sources with current data are listed in the workshop wiki. In my view, it is not necessary to repeat them here.

new proposal paragraph 1, ws 1b:
Child sexual abuse material and other unlawful content massively violates the rights of those affected and those who happen to come into contact with it by accident. All stakeholders recognise that measures and regulations must be put in place to protect vulnerable groups, e.g. children. They also acknowledge that the rights and needs for protection from violence and abuse as well as privacy and participation of all must be equally guaranteed.

@Velofisch Actually I am not at all convinced that “these methods” minimise the impact on privacy. One of the fundamental problems with Andrew’s claims is that client-side scanning places, on every device or handset, the means to inspect the individual’s communications. From that point on, you are wholly dependent on the good-faith action of the authorities to use that tool only as specified. You can’t stop it from being used to inspect everything. In my view, that is a risk wholly disproportionate to the stated goals of this approach.

It gets worse, in my view. Client-side scanning (as envisaged by Andrew) takes place regardless of any basis for suspicion. This reverses the “presumption of innocence”. It starts with the assumption that everyone is committing a CSA offence, and goes looking for the evidence. That mindset ought not to be acceptable to any citizen in a democratic society.