The importance of sharing CSAM detection indicators cannot be overstated, it significantly improves detection at scale. Despite multiple requests for #DFIR activities, we were denied access to these databases. This restriction is a missed opportunity, as it limits detection capabilities.
Frankly, I don’t see the risks of sharing these indicators. The cybersecurity community has been sharing IoCs, malware hashes, and domains for years. Why should CSAM indicators be treated differently? With technologies like encrypted Bloom filters, even public sharing can be done securely.
If we truly want broad and effective detection in #fediverse and other social networks, we need widespread sharing of CSAM indicators.