A federal court ruled Apple cannot be forced to scan iCloud for CSAM, but the judge who agreed is asking Congress to change the law

Apple Beats CSAM Suit. Judge Says Congress Must Force Scans

Apple won a lawsuit from survivors of child sexual abuse material who argued the company should scan iCloud photos for known CSAM. A federal court dismissed every claim. But the judge who agreed used her ruling to invite Congress to pass a law that could strip that shield away.

The case, Amy v. Apple, turned on Section 230 of the Communications Decency Act. Judge Wise concluded that Apple's decision not to scan user-uploaded iCloud files qualifies as a content moderation choice, which Section 230 shields from liability 1. The court found that even internal Apple communications showing the company knew iCloud hosted child pornography do not alter that result under current law 1.

How Apple arrived at this courtroom is its own story. The company passed on PhotoDNA, the scanning technology competitors adopted, and developed an alternative called NeuralHash 1. Goldman writes that NeuralHash "apparently wasn't as good" 1. Apple then reversed course on scanning and brought end-to-end encryption to iCloud storage 1. The plaintiffs, identified in court filings as CSAM survivors, contended that Apple had demonstrated the capacity to detect harmful material and then elected to walk away 1.

Plaintiffs tried several routes around Section 230. They invoked exceptions established in recent cases involving Twitter and Snapchat, but Judge Wise ruled those carveouts apply to content reporting systems, not to a company's failure to build scanning infrastructure 1.

Then the opinion takes an unusual turn. Judge Wise wrote that no statute currently obligates companies to proactively detect CSAM, and that if legislators want the problem addressed, "they must require it under the law" 1. She acknowledged that mandatory detection "would come at a cost of at least some loss of privacy for millions of people" 1.

Legal analyst Eric Goldman argues the opinion spends too little time on that cost. The ruling turns to encryption on just two occasions, treating it as a secondary concern. But encryption, Goldman writes, is "the critical attribute underlying Apple's moves" 1. Apple's pivot to end-to-end encryption is not a side effect of abandoning NeuralHash. It is the architectural decision that made the entire legal dispute possible.

The stakes Goldman identifies extend past Apple. A scanning mandate would require stripping end-to-end encryption from every iCloud account, not only those tied to criminal investigations. End-to-end encryption means the account holder alone holds the keys to decrypt stored content. Building a scanning channel into that architecture creates a new entry point where none currently exists, one that criminal hackers and government actors could exploit to access private files 1. Goldman references the North Korean breach of Sony Pictures and the large-scale theft of private celebrity photographs as evidence that intercepted files produce new categories of victims 1.

The dilemma Judge Wise has placed before Congress has no clean resolution. Require proactive scanning and every person who stores files in the cloud forfeits a layer of cryptographic protection currently shielding their photos, documents, and private communications. Preserve encryption and known CSAM continues to move through services that have already demonstrated they can build detection tools but face no legal duty to deploy them.

The dismissal heads to the Ninth Circuit on appeal 1. But the ruling casts a longer shadow over Capitol Hill. Judge Wise did more than close a case. She handed legislators a ready-made framework for compelling cloud providers to scan user files, paired with her own acknowledgment of the privacy price that framework carries. Whether that price is one society should accept is a question the courts have explicitly left to Congress to answer.