6s5xz
TL;DR
Phones sold within the UK will scan all your photos & video to check that they are allowed, if something is flagged then the Police are notified.
This is already done if you use something like Google Photos.
Let me explain what usually happens in terms of collecting info about CSAM.
NCMEC have a database of known CSAM, its called the IWF hash list, which is their hash list and is updated manually, daily, by 2 people for each picture (what a horrific job, I feel for someone who has to carry this out).
Google also contributes to this database, and in fact are one of the largest contributors (Well done Google, finally your doing something for the greater good it seems), however, I suspect they scan photos hashes in Google products (not the actual image) and if it is a match, report it, this is how Apple was going to do it.
I've had a very quick scan of that doc, and I'm not seeing anything on page 20 which matches your TLDR?, I suspect it would be done on hash, yes it's not great as its still technically scanning your photos, but its not viewing it, a hash is a much more efficient way of doing it also, it gives better accuracy, and doesn't require a lot of compute to do a hash check (think like doing an MD5 check)
I would say, a better solution (and how it may have been designed by OEMs, I dunno) is to have a secure element (think Titan M) and download the hash list to this element, the hash list won't be massive, and you could put storage into the chip to hold it, that way it is tamper proof, doesn't need to transmit data outbound unless absolutely required, but can be updated, similar to a firmware update, and can enforce and prevent viewing / potential creation and distribution of CSAM using maybe a native API or function of the OS.
The alerting of the police would be fairly simple, but it is potentially quite a privacy invasive way, you could use the IMEI of the phone (which isn't a great way, but gives a high degree of accuracy of the device / owner) and bind it to the reported hash value flagged, who this data would be sent to before being reported to the police, I dunno, but I suppose also, if your involved in CSAM outside of a legitimate reason (law enforcement case for example), you should be outed.
However, regardless, this is not a fix to the root cause here, parents need to parent, kids shouldn't be exposed to things like Roblox at such a young age, but this is the parents job, not tech companies, its very hard without real ID (and that's proven to be a trivial bypass) to prove someone is an age, platforms like Facebook, Roblox etc should be 18+ only, but how to verify a user in a private way is a hard problem to solve, credit cards are an okay way to do it, as it exposes a small amount of info in comparison to photo ID, and it has protection from the bank who issue it, as it is their account.
I am all for finding predators, I have a family member who was a judge who signed warrants to arrest people for this stuff, and you could tell when it was bad as he had to view the content, so whoever decides its okay to ruin a persons life (adults are affected also, be it child abuse or abuse as an adult, as child abuse like this never leaves them), should face the full extent of the law, but I think the govt saying this is to "protect the children" is bullshit, if it really was, they would be looking at ways to do it in a privacy respecting way, and engaging communities and experts to help architect this.
But lets also not forget, we have had some extremely high profile people in the UK (and other countries) in institutions like our media, and govt who have been outed for doing this, so will they face the same rules because of this? time will tell.
TLDR, I'm all for tools and systems which can help prevent CSAM, if its done in the right way, privately, exposes the absolute minimum amount of data if any way actually required outside a hash, ideally is open source (so we can make it better, as well as see what's happening), and goes to approved institutions like NCMEC when flagged ONLY, which is encrypted, however, I don't think this is why the govt is doing this, the online ID thing has already stopped people going to sites which may provide information which is not "safe" and could be classed as censorship.