The use of controversial phone-scanning technologies should be considered to detect child abuse images, according to a new paper from GCHQ and the NCSC officials.

In a co-authored paper, NCSC Technical Director Ian Levy and GCHQ Technical Director of Cryptanalysis Crispin Robinson aim to push the debate around children’s online safety and the use of end-to-end encrypted on messaging platforms.

The two touted the use of ‘client-side scanning’, a technology where companies such as Facebook or Apple create software to monitor their users’ communications. The software aims to spot any suspicious content shared on the device without having to communicate with a centralised server.

Among their suggestions was using child protection NGOs to ensure governments do not use the phone-scanning technology to conduct surveillance on innocent people.

They considered using encryption to keep the technology providers or platforms from accessing users’ images directly. Instead, the child protection NGOs would receive the images for moderation.

In addition, the paper lays out seven so-called ‘harm archetypes’ along with technical profiles for each to help address the behaviour.

“We hope this paper will help the debate around combating child sexual abuse on end-to-end encrypted services, for the first time setting out clearly the details and complexities of the problem,” the two authors wrote.

They called for a plan by tech giant Apple to be revisited. The company previously announced plans to use phone-scanning to fight against child abuse images. Back in 2021, it said it would install software on iPhones in the US that would use AI to scan photos before they were uploaded to the iCloud.

These images would then be compared to a database of known child abuse images, with any scoring a close enough match being flagged.

In order to protect users’ privacy, the technology uses a hashing process, where the image is encrypted into a unique alphanumeric string. The strings are then compared against each other, theoretically preserving the user’s privacy.

The plan has since been put on pause indefinitely, but according to the paper calls for re-evaluating the proposal. The reason for opposition to it and similar plans, the two authors noted, was down to specific and fixable flaws.

“We’ve found no reason why client-side scanning techniques cannot be implemented safely in many of the situations one will encounter,” they said in their co-authored paper.

Recommended

• Meet 10 exciting Scottish fintech companies
• The most desirable IoT jobs
• UK and US collaboration to unleash potential of privacy-enhancing tech

One of the core technologies preventing organisations from accessing messages and content sent between phones is the use of end-to-end encryption.

This sees content encrypted at the point of departure and decrypted at the point of receipt, with the key needed to decrypt the message only shared between sender and receiver. As such, nobody can access the information in transit – not hackers, the platforms facilitating the transfer, or authorities.

The practice is controversial. Proponents are in favour of its greater privacy and security, ensuring sensitive data is protected.

On the other hand, it has been accused of facilitating crime and terrorism. The Children’s Commissioner’s Office (CCO) has criticised the practice, saying it puts children at risk.

The UK Government has put pressure on tech companies to end the practice through its Online Safety Bill, requiring companies to put backdoors into the encryption.

Get the latest news from DIGIT direct to your inbox

Our newsletter covers the latest technology and IT news from Scotland and beyond, as well as in-depth features and exclusive interviews with leading figures and rising stars.

To subscribe, click here.