A group of leading cybersecurity experts has spoken out against Apple’s plan to detect child sexual abuse images on iPhones, claiming it amounts to mass surveillance and should be banned.

Earlier this year, Apple announced plans to introduce client side scanning, searching individual devices’ iCloud photo libraries for child sexual abuse material (CSAM). Images would be scanned using a technology called NeuralHash and then compared with known CSAM material, before being reported to the authorities.

The plans were delayed last month, with Apple stating that feedback from customers, advocacy groups, researchers and others was prompting it to look for improvements.

Now, though, there’s more feedback, and from sources that it’s hard to downplay. In a paper titled Bugs in our Pockets: The Risks of Client-Side Scanning, security and cryptograhy experts Hal Abelson, Ross Anderson, Steven M. Bellovin, Josh Benaloh, Matt Blaze, Jon Callas, Whitfield Diffie, Susan Landau, Peter G. Neumann, Ronald L. Rivest, Jeffrey I. Schiller, Bruce Schneier, Vanessa Teague, and Carmela Troncoso claim the technology goes much too far.

“In this report, we argue that CSS neither guarantees efficacious crime prevention nor prevents surveillance,” they write.

“Indeed, the effect is the opposite. CSS by its nature creates serious security and privacy risks for all society while the assistance it can provide for law enforcement is at best problematic. There are multiple ways in which client-side scanning can fail, can be evaded, and can be abused.”

The main fear is the risk of abuse by repressive governments. While Apple says that only CSAM and terrorist material would be flagged, the researchers aren’t so sure.

“If device vendors are compelled to install remote surveillance, the demands will start to roll in. Who could possibly be so cold-hearted as to argue against the system being extended to search for missing children?” writes Ross Anderson, professor of security engineering at the University of Cambridge.

“Then President Xi will want to know who has photos of the Dalai Lama, or of men standing in front of tanks; and copyright lawyers will get court orders blocking whatever they claim infringes their clients’ rights.”

With the EU believed to be considering device scanning as a part of a new law on child protection, the researchers say that it should be a national-security priority to ‘resist attempts to spy on and influence law-abiding citizens’.

And, they point out, the Data Retention Directive has already been struck down on the grounds that such bulk surveillance, without warrant or suspicion, was an unacceptable infringement of privacy, even in the fight against terrorism.

Client-side scanning is equally problematic, the researchers say.

“Instead of having targeted capabilities such as to wiretap communications with a warrant and to perform forensics on seized devices, the agencies’ direction of travel is the bulk scanning of everyone’s private data, all the time, without warrant or suspicion,” they write.

“That crosses a red line. Is it prudent to deploy extremely powerful surveillance technology that could easily be extended to undermine basic freedoms?”