CSS Technology does not exist
The "The Risks of Client-Side Scanning" paper talks about CSS (client side scanning) ‘Technology’ as if it exists (and then has a big hissy fit over it). But it does not exist — it would have to be an OS service (likely internal, private), that could be employed by entitled process (originating from capitulating vendor or inserted by OS exploiter). However, CSS as an approach certainly exists. Apple's CSAM image db match detection uses the CSS approach but is custom code. To redeploy that code (use a different neural hash db, change the detection thresholds, change the command & control) you would have to do quite a lot of hacking, but then you've lost bulk distribution. In no way is it flip a data switch to redeploy for different purpose.
Apple's CSAM image detection arrives via OS distribution, integral with the OS. That they deployed a CSS approach changes nothing. They could already have included code as a result of capitulation in previous versions, and they could do in future. That they are tackling their obligation not to host CSAM images does not tell us if/when they will/have capitulate(d) with other jurisdictional pressures around the world. And if/when they do, it will be inclusion and distribution of another chunk of custom code targeting a different need in a different optimal way. It wont be trying to make a helicopter out of a boat.
Biting the hand that feeds IT
