6 ms·

China requires Chinese user data to be stored on servers physically located in China, and foreign entities are required to take on local partners for operations

China requires Chinese user data to be stored on servers physically located in China, and foreign entities are required to take on local partners for operations within China. I don't think either of those stipulations will come as a galloping shock to anyone here, and taken together they fully explain the reason for this change. The question I'm then moved to ask is this: who cares, so long as the data is e2e encrypted?

AlphaWeaver 9y ago
This article explains that there's a new stipulation in the Terms of Service permitting Apple (and their new partner which will operate this datacenter) to view, share, and disclose your data as they see fit. This is about compliance, yes, but we can't ignore the political implications of this change.
tonyztan 9y ago
The problem is that we don't know what is encrypted, how, and who holds the keys: https://blog.cryptographyengineering.com/2018/01/16/icloud-in-china/ https://blog.cryptographyengineering.com/2018/01/16/icloud-i...
- threeseed 9y ago
  I would be surprised/mortified if Apple didn't hold the keys. Otherwise iCloud Keychain which houses credentials for non-Apple sites would be exposed. I can't imagine the likes of Facebook, Google, Amazon etc just sitting back and allowing Apple to compromise their sites in the name of Chinese expansion. It would surely amount to the biggest security compromise in history if this was the case.
  - sneak 9y ago
    Google and Facebook are already blocked there.
    - threeseed 9y ago
      Maybe you don't understand. In my iCloud Keychain is the credentials for EVERY website that I have basically ever signed it into. It has credentials for internet banking, work email and VPN, AWS and Google Cloud etc. Just for me it is over 250 websites. It even stores SSH keypairs. If the Chinese government had the ability to access those for all Chinese iCloud users (and roaming tourists ?) that would a seriously big deal.
      - walterbell 9y ago
        Would a local-only iOS password manager reduce this exposure?
      - rarepostinlurkr 9y ago
        That’s not how iCloud Keychain works. It’s a transfer method for data encrypted by keys only your circle has. You control who is added not Apple. Read the white paper
        sneak 9y ago
        In theory you control who is added to an iMessage too, but Apple’s closed source software is what does the controlling. Enter a government wiretap, and boom.
        willstrafach 9y ago
        I am not sure why closed-source code would be relevant here. The opaque aspect in this case would be the server handling it, not the device.
        sneak 9y ago
        iMessage is end to end encrypted.
        tonyztan 9y ago
  - seanmcdirmid 9y ago
    Apple doesn't hold the keys, they've outsourced responsibility to Guizhou on the Cloud Big Data Industrial Development Co., Ltd.
    - threeseed 9y ago
      That doesn't mean they have transferred the keys. You can manage and operate a data centre without needing the keys to the HSM.
      - seanmcdirmid 9y ago
        The whole reason they did this in the first place was to not have control over the data, they definitely don’t have the keys. The Chinese police/government contact Guizhou, not Apple, when they want anything.
        culturestate 9y ago
        This comes back to my initial question: if data is encrypted by my key before it ever leaves my device, as Apple has repeatedly claimed, why should it matter to me? China can have all the encrypted blobs of my data they want. I have to assume that unencrypted information has always been available to the CCP on request, even more readily than it is to US law enforcement.
- tonyedgecombe 9y ago
  We do to an extent: https://support.apple.com/en-us/HT202303 https://support.apple.com/en-us/HT202303
kodablah 9y ago
> The question I'm then moved to ask is this: who cares [...] Many care because Apple's motives and principles wrt privacy are often used as a reason to choose them. That they haven't stated publicly that they are complying but disagree (like they have in other instances) makes many wonder whether Apple is honest about their motives and principles. I understand the critical among us know it's all about the money, but others do want to know why Apple publicly states its beliefs in one case and not the other (again, not about compliance, just about public disagreement).
contingencies 9y ago
foreign entities are required to take on local partners for operations within China This is not completely correct. Legally you can operate at least a joint venture (JV), a limited company (有限公司), or a representative or branch office for a foreign company (分公司 or 代理公司). When operating a limited company, they may be Wholly Foreign Owned Enterprises (WFOE, known as a "woofie"), also categorized as "foreign invested" (外资).
- seanmcdirmid 9y ago
  Depends on the industry, of course. Car companies are famous for being forced into 49/51 JVs.

AlphaWeaver 9y ago

This article explains that there's a new stipulation in the Terms of Service permitting Apple (and their new partner which will operate this datacenter) to view, share, and disclose your data as they see fit. This is about compliance, yes, but we can't ignore the political implications of this change.

tonyztan 9y ago

The problem is that we don't know what is encrypted, how, and who holds the keys: https://blog.cryptographyengineering.com/2018/01/16/icloud-in-china/ https://blog.cryptographyengineering.com/2018/01/16/icloud-i...

threeseed 9y ago
I would be surprised/mortified if Apple didn't hold the keys. Otherwise iCloud Keychain which houses credentials for non-Apple sites would be exposed. I can't imagine the likes of Facebook, Google, Amazon etc just sitting back and allowing Apple to compromise their sites in the name of Chinese expansion. It would surely amount to the biggest security compromise in history if this was the case.
- sneak 9y ago
  Google and Facebook are already blocked there.
  - threeseed 9y ago
    Maybe you don't understand. In my iCloud Keychain is the credentials for EVERY website that I have basically ever signed it into. It has credentials for internet banking, work email and VPN, AWS and Google Cloud etc. Just for me it is over 250 websites. It even stores SSH keypairs. If the Chinese government had the ability to access those for all Chinese iCloud users (and roaming tourists ?) that would a seriously big deal.
    - walterbell 9y ago
      Would a local-only iOS password manager reduce this exposure?
    - rarepostinlurkr 9y ago
      That’s not how iCloud Keychain works. It’s a transfer method for data encrypted by keys only your circle has. You control who is added not Apple. Read the white paper
      - sneak 9y ago
        In theory you control who is added to an iMessage too, but Apple’s closed source software is what does the controlling. Enter a government wiretap, and boom.
        willstrafach 9y ago
        I am not sure why closed-source code would be relevant here. The opaque aspect in this case would be the server handling it, not the device.
        sneak 9y ago
        iMessage is end to end encrypted.
        tonyztan 9y ago
- seanmcdirmid 9y ago
  Apple doesn't hold the keys, they've outsourced responsibility to Guizhou on the Cloud Big Data Industrial Development Co., Ltd.
  - threeseed 9y ago
    That doesn't mean they have transferred the keys. You can manage and operate a data centre without needing the keys to the HSM.
    - seanmcdirmid 9y ago
      The whole reason they did this in the first place was to not have control over the data, they definitely don’t have the keys. The Chinese police/government contact Guizhou, not Apple, when they want anything.
      - culturestate 9y ago
        This comes back to my initial question: if data is encrypted by my key before it ever leaves my device, as Apple has repeatedly claimed, why should it matter to me? China can have all the encrypted blobs of my data they want. I have to assume that unencrypted information has always been available to the CCP on request, even more readily than it is to US law enforcement.
tonyedgecombe 9y ago
We do to an extent: https://support.apple.com/en-us/HT202303 https://support.apple.com/en-us/HT202303

kodablah 9y ago

> The question I'm then moved to ask is this: who cares [...] Many care because Apple's motives and principles wrt privacy are often used as a reason to choose them. That they haven't stated publicly that they are complying but disagree (like they have in other instances) makes many wonder whether Apple is honest about their motives and principles. I understand the critical among us know it's all about the money, but others do want to know why Apple publicly states its beliefs in one case and not the other (again, not about compliance, just about public disagreement).

contingencies 9y ago

foreign entities are required to take on local partners for operations within China This is not completely correct. Legally you can operate at least a joint venture (JV), a limited company (有限公司), or a representative or branch office for a foreign company (分公司 or 代理公司). When operating a limited company, they may be Wholly Foreign Owned Enterprises (WFOE, known as a "woofie"), also categorized as "foreign invested" (外资).

seanmcdirmid 9y ago
Depends on the industry, of course. Car companies are famous for being forced into 49/51 JVs.