7 ms·

Apple is in a good position in the market to do this, but it is just really hard to trust any US company. They say they will never give anyone access to their

Apple is in a good position in the market to do this, but it is just really hard to trust any US company. They say they will never give anyone access to their servers but how can they make that promise when they don't make the laws? As an aside I am finding it really difficult to delete my iCloud account, in fact it seems that is impossible.

karmelapple 11y ago
Genuine curiosity: which country would a company need to be in to be able to trust them?
- zxcvcxz 11y ago
  That's not what it's about for me. If companies like google and Apple want my trust they need to operate as their own government entity and make all users citizens and give them rights. Until then I'll stick to using as much FOSS as possible, never using social media for secure communication, and storing all my own data. Basically, unless they let me see what's happening with my data by allowing me access to the code, I can't and won't trust them.
- atmosx 11y ago
  Switzerland, Netherlands and Norway are a good starting point. I believe that now that privacy became a major concern, we will see countries with some legislative background and experience in other sectors that require secrecy above everything else (e.g. private banking), evolve in secure havens for servers.
  - jboy55 11y ago
    A lot has been written about secret US courts giving secret warrants to spy on US networks or force companies to give keys. Infiltrating foreign servers, installing backdoors and such don't require any warrant or court approval.
  - vezzy-fnord 11y ago
    Switzerland has their own private domestic SIGINT network known as Onyx, and has had other surveillance scandals before. [1] [1] https://en.wikipedia.org/wiki/Secret_files_scandal https://en.wikipedia.org/wiki/Secret_files_scandal
    - chappi42 11y ago
      You link to something (Fichenaffäre) that happened more than 25 years before...
      - vezzy-fnord 11y ago
        I find it reasonable to assume the program was never folded, only rearranged. Much like Total Information Awareness.
  - tremon 11y ago
    The Netherlands is on its way to be removed from that short list. The new WIV20xx (charter for information and security services) gives it very broad powers against very little oversight. I have been unable to find a decent source in English, but among its provisions: - allows for "reconnaissance" on external networks, including breaking encryption or forcing targets to divulge keys. This "reconnaissance" apparently includes installing sniffers or data probes. - allows for untargeted data collection on wired networks (including cell phone towers) - has provisions for forcing data transit stations (including ISP's, but also AMS-IX) to comply with requests. Only English source I've been able to find with a quick search is https://blog.cyberwar.nl/2015/07/dutch-intelligence-bill-proposes-non-specific-bulk-interception-powers-for-any-form-of-telecom-or-data-transfer-incl-domestic/ https://blog.cyberwar.nl/2015/07/dutch-intelligence-bill-pro...
- caskance 11y ago
  It depends on what you are trusting them to do. The NSA's not going to spy on you less just because you're not in the US. If anything, they'd spy on you more.
  - angelbob 11y ago
    Sure, but they'll have more trouble getting cooperation from non-US companies you're using.
    - caskance 11y ago
      They would no longer need to ask for cooperation. Personally, I'd call that less safe. At least in theory, the NSA could allow a compliant US business to be secure. If the NSA could not get data from a foreign business the easy way, I'm sure they would get it the hard way.
Bud 11y ago
Changes in laws cannot provide access to data that was never gathered and stored in the first place. Similarly, laws cannot force a company to divulge encrypted data if the company does not hold the encryption keys. So as long as you trust the company, the country it's in is not relevant, at least for the situations outlined above.
- treerock 11y ago
  > Changes in laws cannot provide access to data that was never gathered and stored in the first place. Laws can and have been written that require companies to gather data. > Similarly, laws cannot force a company to divulge encrypted data if the company does not hold the encryption keys. Laws can and have been written that require companies to use weaker or broken encryption.
  - Bud 11y ago
    True, of course. But we would presumably know about these laws, in advance, and we would have the ability to make choices based on this knowledge. Apple has thus far been steadfast in resisting this sort of activity and in advocating against any such laws. So for me at least, this is behavior that is worthy of trust.
    - SideburnsOfDoom 11y ago
      > But we would presumably know about these laws, in advance Court rulings and legal authorisations to conduct surveilance can and have ... you guessed it ... been kept secret
      - Bud 11y ago
        Also true. But we know from the Snowden revelations and other sources that Apple has been backing up its promises. So we have at least some level of assurance that Apple is a good actor.
  - spott 11y ago
superuser2 11y ago
Locating data outside the US is in no way a defense against US intelligence agencies. There are theoretically controls on domestic spying, and some possibility that Congress could make it illegal. They have a mandate to spy on foreign networks. If they haven't cracked your European email provider, then they're not doing what we pay and order them to do.
- chappi42 11y ago
  > If they haven't cracked your European email provider, then they're not doing what we pay and order them to do. You - sorry to say - would have fucking other issues to solve and fund than spying on your supposed to be friend states email providers. As a suggestion and for a start: fix up your broken justice (prison overpopulation). And then there is this wild west NRA gun idiocy... next crazy shooting is just bound to happen soon enough again. Such a sad pity. I'd suggest you go 'deep inside you' and think again what should be the priorities to pay for. Thanks!
  - meepmorp 11y ago
    > I'd suggest you go 'deep inside you' and think again what should be the priorities to pay for. Thanks! As you're perhaps aware, the US is a large country (in area and population), with a political system that depends on a sharply divided electorate. The things you seem to think are obvious issues to tackle are actually rather controversial, and prone to demagoguing by opportunistic politicians. Congratulations on the ideal political process in your home country. Perhaps one day we'll attain the same level of enlightenment; or perhaps you'll gain a bit of maturity and understanding of the landscape here, and develop more realistic ideas about the US. Thanks!
    - chappi42 11y ago
      (7 days after) I'm of course aware of the political system. Thanks. My comment is about the personal statement 'cracked your European email provider, then they're not doing what we pay' which I understand that he is very much in approval of 'we pay'. Maybe I should have restrained from the additional remarks. But I got frustrated about a fellow hacker newser kind of defending intruding friend nation companies and not willing to improve at home. (Yes I would accept that it may not be possible or easy). [But - what a pity - the next shooting didn't wait long to happen. Maybe The Economist has a good and realistic understanding of the landscape, writing: "Those who live in America, or visit it, might do best to regard them [the Normalization of Gun Massacres] the way one regards air pollution in China: an endemic local health hazard which, for deep-rooted cultural, social, economic and political reasons, the country is incapable of addressing.". And then they continue: "This may, however, be a bit unfair. China seems to be making progress on pollution."] Now your turn!
d_theorist 11y ago
To paraphrase Spock, "Even laws must give way to mathematics".
- fauigerzigerk 11y ago
  But not to its application.
- caskance 11y ago
  Spock also said "Insufficient facts always invite danger”.
huhtenberg 11y ago
One doesn't need to give access to their servers in order to give access to their data. You just set up a hot spare and sync it over a leaky protocol, like FTP. Ta-da! Both the marketing and the NSA are happy as clams.
chappi42 11y ago
Very well written text. I like the simple and comprehensible language. Other companies should take this as an example. (Only problem: many other companies likely wouldn't want to tell in plain words how broad they are gathering and aggregating your (my) data)
- sangnoir 11y ago
  I don't think I'm being overly cynical, but I'm seeing qualifiers[1] all over the place. The phrases seem carefully constructed to suggest more privacy than what is actually offered. For example: "We don’t build a profile based on your email content or web browsing habits to sell to advertisers" but we do build profiles (bonus points for insinuating competition sells your information) "we don’t read your email or your messages to get information to market to you." - but we do read and index your emails and messages, only to make our services and devices 'better' - by our definition The sentences are built to sound like the italicized parts are not there, yet they totally change (negate) the meaning. If I were a murderer, I could say "I do not kill men to eat their livers" and it would be 100% true, but it sounds like I'm not into killing at all. 1. Is that the word? Not a native speaker
DavideNL 11y ago
> but how can they make that promise when they don't make the laws? I agree, like Lavabit... Lavabit had all the best intentions but in the end the law screwed them over anyway. Of course Apple has a lot more power than Lavabit, so it's nice they are taking this standpoint and being resistant. Hopefully they can contribute to a positive change.. Anyways at least they are trying, something i haven't seen from other big companies, like Google https://en.wikipedia.org/wiki/Criticism_of_Google#Privacy https://en.wikipedia.org/wiki/Criticism_of_Google#Privacy
- cvwright 11y ago
  Lavabit got into trouble because they made promises that they were technically unable to keep. Moxie Marlinspike takes them to task here: http://www.thoughtcrime.org/blog/lavabit-critique/ http://www.thoughtcrime.org/blog/lavabit-critique/
  - DavideNL 11y ago
    i didn't know, thanks great article
Tloewald 11y ago
Setting aside the fact that US intelligence agencies can and will subvert foreign servers with impunity, foreign intelligence agencies operate with less oversight within their own borders than the US agencies do within its borders AND they tend to cooperate with US agencies (or, worse, Russia's or China's).

karmelapple 11y ago

Genuine curiosity: which country would a company need to be in to be able to trust them?

zxcvcxz 11y ago
That's not what it's about for me. If companies like google and Apple want my trust they need to operate as their own government entity and make all users citizens and give them rights. Until then I'll stick to using as much FOSS as possible, never using social media for secure communication, and storing all my own data. Basically, unless they let me see what's happening with my data by allowing me access to the code, I can't and won't trust them.
atmosx 11y ago
Switzerland, Netherlands and Norway are a good starting point. I believe that now that privacy became a major concern, we will see countries with some legislative background and experience in other sectors that require secrecy above everything else (e.g. private banking), evolve in secure havens for servers.
- jboy55 11y ago
  A lot has been written about secret US courts giving secret warrants to spy on US networks or force companies to give keys. Infiltrating foreign servers, installing backdoors and such don't require any warrant or court approval.
- vezzy-fnord 11y ago
  Switzerland has their own private domestic SIGINT network known as Onyx, and has had other surveillance scandals before. [1] [1] https://en.wikipedia.org/wiki/Secret_files_scandal https://en.wikipedia.org/wiki/Secret_files_scandal
  - chappi42 11y ago
    You link to something (Fichenaffäre) that happened more than 25 years before...
    - vezzy-fnord 11y ago
      I find it reasonable to assume the program was never folded, only rearranged. Much like Total Information Awareness.
- tremon 11y ago
  The Netherlands is on its way to be removed from that short list. The new WIV20xx (charter for information and security services) gives it very broad powers against very little oversight. I have been unable to find a decent source in English, but among its provisions: - allows for "reconnaissance" on external networks, including breaking encryption or forcing targets to divulge keys. This "reconnaissance" apparently includes installing sniffers or data probes. - allows for untargeted data collection on wired networks (including cell phone towers) - has provisions for forcing data transit stations (including ISP's, but also AMS-IX) to comply with requests. Only English source I've been able to find with a quick search is https://blog.cyberwar.nl/2015/07/dutch-intelligence-bill-proposes-non-specific-bulk-interception-powers-for-any-form-of-telecom-or-data-transfer-incl-domestic/ https://blog.cyberwar.nl/2015/07/dutch-intelligence-bill-pro...
caskance 11y ago
It depends on what you are trusting them to do. The NSA's not going to spy on you less just because you're not in the US. If anything, they'd spy on you more.
- angelbob 11y ago
  Sure, but they'll have more trouble getting cooperation from non-US companies you're using.
  - caskance 11y ago
    They would no longer need to ask for cooperation. Personally, I'd call that less safe. At least in theory, the NSA could allow a compliant US business to be secure. If the NSA could not get data from a foreign business the easy way, I'm sure they would get it the hard way.

Bud 11y ago

Changes in laws cannot provide access to data that was never gathered and stored in the first place. Similarly, laws cannot force a company to divulge encrypted data if the company does not hold the encryption keys. So as long as you trust the company, the country it's in is not relevant, at least for the situations outlined above.

treerock 11y ago
> Changes in laws cannot provide access to data that was never gathered and stored in the first place. Laws can and have been written that require companies to gather data. > Similarly, laws cannot force a company to divulge encrypted data if the company does not hold the encryption keys. Laws can and have been written that require companies to use weaker or broken encryption.
- Bud 11y ago
  True, of course. But we would presumably know about these laws, in advance, and we would have the ability to make choices based on this knowledge. Apple has thus far been steadfast in resisting this sort of activity and in advocating against any such laws. So for me at least, this is behavior that is worthy of trust.
  - SideburnsOfDoom 11y ago
    > But we would presumably know about these laws, in advance Court rulings and legal authorisations to conduct surveilance can and have ... you guessed it ... been kept secret
    - Bud 11y ago
      Also true. But we know from the Snowden revelations and other sources that Apple has been backing up its promises. So we have at least some level of assurance that Apple is a good actor.
- spott 11y ago

superuser2 11y ago

Locating data outside the US is in no way a defense against US intelligence agencies. There are theoretically controls on domestic spying, and some possibility that Congress could make it illegal. They have a mandate to spy on foreign networks. If they haven't cracked your European email provider, then they're not doing what we pay and order them to do.

chappi42 11y ago
> If they haven't cracked your European email provider, then they're not doing what we pay and order them to do. You - sorry to say - would have fucking other issues to solve and fund than spying on your supposed to be friend states email providers. As a suggestion and for a start: fix up your broken justice (prison overpopulation). And then there is this wild west NRA gun idiocy... next crazy shooting is just bound to happen soon enough again. Such a sad pity. I'd suggest you go 'deep inside you' and think again what should be the priorities to pay for. Thanks!
- meepmorp 11y ago
  > I'd suggest you go 'deep inside you' and think again what should be the priorities to pay for. Thanks! As you're perhaps aware, the US is a large country (in area and population), with a political system that depends on a sharply divided electorate. The things you seem to think are obvious issues to tackle are actually rather controversial, and prone to demagoguing by opportunistic politicians. Congratulations on the ideal political process in your home country. Perhaps one day we'll attain the same level of enlightenment; or perhaps you'll gain a bit of maturity and understanding of the landscape here, and develop more realistic ideas about the US. Thanks!
  - chappi42 11y ago
    (7 days after) I'm of course aware of the political system. Thanks. My comment is about the personal statement 'cracked your European email provider, then they're not doing what we pay' which I understand that he is very much in approval of 'we pay'. Maybe I should have restrained from the additional remarks. But I got frustrated about a fellow hacker newser kind of defending intruding friend nation companies and not willing to improve at home. (Yes I would accept that it may not be possible or easy). [But - what a pity - the next shooting didn't wait long to happen. Maybe The Economist has a good and realistic understanding of the landscape, writing: "Those who live in America, or visit it, might do best to regard them [the Normalization of Gun Massacres] the way one regards air pollution in China: an endemic local health hazard which, for deep-rooted cultural, social, economic and political reasons, the country is incapable of addressing.". And then they continue: "This may, however, be a bit unfair. China seems to be making progress on pollution."] Now your turn!

d_theorist 11y ago

To paraphrase Spock, "Even laws must give way to mathematics".

fauigerzigerk 11y ago
But not to its application.
caskance 11y ago
Spock also said "Insufficient facts always invite danger”.

huhtenberg 11y ago

One doesn't need to give access to their servers in order to give access to their data. You just set up a hot spare and sync it over a leaky protocol, like FTP. Ta-da! Both the marketing and the NSA are happy as clams.

chappi42 11y ago

Very well written text. I like the simple and comprehensible language. Other companies should take this as an example. (Only problem: many other companies likely wouldn't want to tell in plain words how broad they are gathering and aggregating your (my) data)

sangnoir 11y ago
I don't think I'm being overly cynical, but I'm seeing qualifiers[1] all over the place. The phrases seem carefully constructed to suggest more privacy than what is actually offered. For example: "We don’t build a profile based on your email content or web browsing habits to sell to advertisers" but we do build profiles (bonus points for insinuating competition sells your information) "we don’t read your email or your messages to get information to market to you." - but we do read and index your emails and messages, only to make our services and devices 'better' - by our definition The sentences are built to sound like the italicized parts are not there, yet they totally change (negate) the meaning. If I were a murderer, I could say "I do not kill men to eat their livers" and it would be 100% true, but it sounds like I'm not into killing at all. 1. Is that the word? Not a native speaker

DavideNL 11y ago

> but how can they make that promise when they don't make the laws? I agree, like Lavabit... Lavabit had all the best intentions but in the end the law screwed them over anyway. Of course Apple has a lot more power than Lavabit, so it's nice they are taking this standpoint and being resistant. Hopefully they can contribute to a positive change.. Anyways at least they are trying, something i haven't seen from other big companies, like Google https://en.wikipedia.org/wiki/Criticism_of_Google#Privacy https://en.wikipedia.org/wiki/Criticism_of_Google#Privacy

cvwright 11y ago
Lavabit got into trouble because they made promises that they were technically unable to keep. Moxie Marlinspike takes them to task here: http://www.thoughtcrime.org/blog/lavabit-critique/ http://www.thoughtcrime.org/blog/lavabit-critique/
- DavideNL 11y ago
  i didn't know, thanks great article

Tloewald 11y ago

Setting aside the fact that US intelligence agencies can and will subvert foreign servers with impunity, foreign intelligence agencies operate with less oversight within their own borders than the US agencies do within its borders AND they tend to cooperate with US agencies (or, worse, Russia's or China's).