5 ms·

When one travels to China, is the iCloud data entirely compromised?

9 points by 29_29 7y ago

I'm looking for someone that works at Apple iCloud that can speak authoritatively. When one travels to China, is the iCloud data entirely compromised by Chinese access? For example is it all synched?

Despegar 7y ago
Apple has already publicly said in court filings, and under threat of perjury, that they don't make any exceptions for China. From Apple's filing [1]: >Finally, the government attempts to disclaim the obvious international implications of its demand, asserting that any pressure to hand over the same software to foreign agents “flows from [Apple’s] decision to do business in foreign countries . . . .” Opp. 26. Contrary to the government’s misleading statistics (Opp. 26), which had to do with lawful process and did not compel the creation of software that undermines the security of its users, Apple has never built a back door of any kind into iOS, or otherwise made data stored on the iPhone or in iCloud more technically accessible to any country’s government. See Dkt. 16-28 [Apple Inc., Privacy, Gov’t Info. Requests]; Federighi Decl. ¶¶ 6–7. The government is wrong in asserting that Apple made “special accommodations” for China (Opp. 26), as Apple uses the same security protocols everywhere in the world and follows the same standards for responding to law enforcement requests. See Federighi Decl. ¶ 5. and a declaration from Craig Federighi personally [2]: >Apple uses the same security protocols everywhere in the world. >Apple has never made user data, whether stored on the iPhone or in iCloud, more technologically accessible to any country's government. We believe any such access is too dangerous to allow. Apple has also not provided any government with its proprietary iOS source code. While governmental agencies in various countries, including the United States, perform regulatory reviews of new iPhone releases, all that Apple provides in those circumstances is an unmodified iPhone device. >It is my understanding that Apple has never worked with any government agency from any country to create a "backdoor" in any of our products and services. >I declare under penalty of perjury under the laws of the United States of America that the foregoing is true and correct. When China wants something from iCloud they do it the same way that law enforcement does it everywhere in the world, which is through Apple. [1] https://assets.documentcloud.org/documents/2762131/C-D-Cal-16-Cm-00010-Dckt-000177-000-Filed-2016.pdf https://assets.documentcloud.org/documents/2762131/C-D-Cal-1... [2] https://www.documentcloud.org/documents/2762118-Federighi-Decl-Executed.html#document/p1 https://www.documentcloud.org/documents/2762118-Federighi-De...
- cynix 7y ago
  > It is my understanding that Apple has never worked with any government agency from any country to create a "backdoor" in any of our products and services. So Craig's declaration is not that they haven't created any backdoors for governments, just that he doesn't know of any.
  - Despegar 7y ago
    That's an uncharitable reading of an extremely clear statement. And it's also understandable why it's less affirmative. He's being conservative because he can't speak for what everyone who works for him may or may not have done, for example a rogue employee. The main Apple filing is unequivocal: >Apple has never built a back door of any kind into iOS, or otherwise made data stored on the iPhone or in iCloud more technically accessible to any country’s government. The government is wrong in asserting that Apple made “special accommodations” for China (Opp. 26), as Apple uses the same security protocols everywhere in the world and follows the same standards for responding to law enforcement requests.
  - lern_too_spel 7y ago
    Craig's declaration might have been true in 2016 when he made it. It definitely has not been true since 2018. https://www.amnesty.org/en/latest/news/2018/02/5-things-you-need-to-know-about-apple-in-china/ https://www.amnesty.org/en/latest/news/2018/02/5-things-you-...
    - Despegar 7y ago
      Replying to this just for anyone else that reads this later: Tim Cook confirmed this was still the case in this 2018 interview with Vice. https://www.youtube.com/watch?v=VD1cP8SK3Q0&feature=youtu.be&t=244 https://www.youtube.com/watch?v=VD1cP8SK3Q0&feature=youtu.be...
      - vatueil 7y ago
        Transcript of relevant section: https://youtu.be/VD1cP8SK3Q0?t=244 https://youtu.be/VD1cP8SK3Q0?t=244 > VICE News: In terms of privacy as a human right, does that apply to how you do business in China? > Apple CEO Tim Cook: It absolutely does. Encryption for us is the same in every country in the world. We don't design encryption for, you know, for the US and do it differently everywhere else. It's the same. And so to send a message in China, it's encrypted. I can't produce the content. I can't produce it in the United States either. If you lock your phone in China, I can't open it. > The thing in China that some people have confused is certain countries, and China's one of them, has a requirement that data from local citizens has to be kept in China. We worked with a Chinese company to provide iCloud. But the keys, which are- which is the "key" so to speak, pardon the pun, are ours. > VICE: But haven't they moved to China, meaning it's much easier for the Chinese government to get to them? > Cook: No, I wouldn't- I wouldn't get caught up in the, uh, "where's the location" of it. I mean, we have servers located in many different countries in the world. It's- they're not easier to get data, uh, from being in one country versus the next. The key question is, how does the encryption process work, and who owns the keys if anyone. In most cases for us, you and the receiver own the keys. VICE interviews are not held under penalty of perjury, of course, but we may give Apple's CEO the benefit of the doubt. As Mr. Cook acknowledges, Apple did make significant changes to iCloud data storage for Chinese users, though he suggests in "most cases" users have control over encrypted data. The encryption angle was addressed in the article from Amnesty International as well. Since the changes to iCloud for Chinese users in 2018 postdate the court filings in 2016, it does seem reasonable to feel less confidence in previous assurances with regards to China. They are not as ironclad as "threat of perjury" might suggest, at least.
Spooky23 7y ago
For Chinese users, iCloud is operated by Cloud Big Data Industrial Development Co., Ltd. My understanding is that Chinese users in mainland China have a different set of product terms that are vague or silent about certain privacy features or what the the Chinese partner does. If you are a foreigner, you use the Apple owned service. What I don’t know is where you connection terminates. With Microsoft, depending on the type of cloud, Office 365 TLS connections terminate at a local Microsoft point of presence. So you are in clear text outside of your jurisdiction for a limited period of time. (Not sure about China, but I’ve verified for other countries.) Bottom line, if I had information of interest to Chinese interests, I wouldn’t expose an account with that data there or would get real paid advice about how to do it.
- 29_29 7y ago
  Thanks for the response, it would be great if this is the case but is this actually true? I'd like to read this from Apple, or an apple spokes person.

9 points by 29_29 7y ago

I'm looking for someone that works at Apple iCloud that can speak authoritatively. When one travels to China, is the iCloud data entirely compromised by Chinese access? For example is it all synched?

Despegar 7y ago

Apple has already publicly said in court filings, and under threat of perjury, that they don't make any exceptions for China. From Apple's filing [1]: >Finally, the government attempts to disclaim the obvious international implications of its demand, asserting that any pressure to hand over the same software to foreign agents “flows from [Apple’s] decision to do business in foreign countries . . . .” Opp. 26. Contrary to the government’s misleading statistics (Opp. 26), which had to do with lawful process and did not compel the creation of software that undermines the security of its users, Apple has never built a back door of any kind into iOS, or otherwise made data stored on the iPhone or in iCloud more technically accessible to any country’s government. See Dkt. 16-28 [Apple Inc., Privacy, Gov’t Info. Requests]; Federighi Decl. ¶¶ 6–7. The government is wrong in asserting that Apple made “special accommodations” for China (Opp. 26), as Apple uses the same security protocols everywhere in the world and follows the same standards for responding to law enforcement requests. See Federighi Decl. ¶ 5. and a declaration from Craig Federighi personally [2]: >Apple uses the same security protocols everywhere in the world. >Apple has never made user data, whether stored on the iPhone or in iCloud, more technologically accessible to any country's government. We believe any such access is too dangerous to allow. Apple has also not provided any government with its proprietary iOS source code. While governmental agencies in various countries, including the United States, perform regulatory reviews of new iPhone releases, all that Apple provides in those circumstances is an unmodified iPhone device. >It is my understanding that Apple has never worked with any government agency from any country to create a "backdoor" in any of our products and services. >I declare under penalty of perjury under the laws of the United States of America that the foregoing is true and correct. When China wants something from iCloud they do it the same way that law enforcement does it everywhere in the world, which is through Apple. [1] https://assets.documentcloud.org/documents/2762131/C-D-Cal-16-Cm-00010-Dckt-000177-000-Filed-2016.pdf https://assets.documentcloud.org/documents/2762131/C-D-Cal-1... [2] https://www.documentcloud.org/documents/2762118-Federighi-Decl-Executed.html#document/p1 https://www.documentcloud.org/documents/2762118-Federighi-De...

cynix 7y ago
> It is my understanding that Apple has never worked with any government agency from any country to create a "backdoor" in any of our products and services. So Craig's declaration is not that they haven't created any backdoors for governments, just that he doesn't know of any.
- Despegar 7y ago
  That's an uncharitable reading of an extremely clear statement. And it's also understandable why it's less affirmative. He's being conservative because he can't speak for what everyone who works for him may or may not have done, for example a rogue employee. The main Apple filing is unequivocal: >Apple has never built a back door of any kind into iOS, or otherwise made data stored on the iPhone or in iCloud more technically accessible to any country’s government. The government is wrong in asserting that Apple made “special accommodations” for China (Opp. 26), as Apple uses the same security protocols everywhere in the world and follows the same standards for responding to law enforcement requests.
- lern_too_spel 7y ago
  Craig's declaration might have been true in 2016 when he made it. It definitely has not been true since 2018. https://www.amnesty.org/en/latest/news/2018/02/5-things-you-need-to-know-about-apple-in-china/ https://www.amnesty.org/en/latest/news/2018/02/5-things-you-...
  - Despegar 7y ago
    Replying to this just for anyone else that reads this later: Tim Cook confirmed this was still the case in this 2018 interview with Vice. https://www.youtube.com/watch?v=VD1cP8SK3Q0&feature=youtu.be&t=244 https://www.youtube.com/watch?v=VD1cP8SK3Q0&feature=youtu.be...
    - vatueil 7y ago
      Transcript of relevant section: https://youtu.be/VD1cP8SK3Q0?t=244 https://youtu.be/VD1cP8SK3Q0?t=244 > VICE News: In terms of privacy as a human right, does that apply to how you do business in China? > Apple CEO Tim Cook: It absolutely does. Encryption for us is the same in every country in the world. We don't design encryption for, you know, for the US and do it differently everywhere else. It's the same. And so to send a message in China, it's encrypted. I can't produce the content. I can't produce it in the United States either. If you lock your phone in China, I can't open it. > The thing in China that some people have confused is certain countries, and China's one of them, has a requirement that data from local citizens has to be kept in China. We worked with a Chinese company to provide iCloud. But the keys, which are- which is the "key" so to speak, pardon the pun, are ours. > VICE: But haven't they moved to China, meaning it's much easier for the Chinese government to get to them? > Cook: No, I wouldn't- I wouldn't get caught up in the, uh, "where's the location" of it. I mean, we have servers located in many different countries in the world. It's- they're not easier to get data, uh, from being in one country versus the next. The key question is, how does the encryption process work, and who owns the keys if anyone. In most cases for us, you and the receiver own the keys. VICE interviews are not held under penalty of perjury, of course, but we may give Apple's CEO the benefit of the doubt. As Mr. Cook acknowledges, Apple did make significant changes to iCloud data storage for Chinese users, though he suggests in "most cases" users have control over encrypted data. The encryption angle was addressed in the article from Amnesty International as well. Since the changes to iCloud for Chinese users in 2018 postdate the court filings in 2016, it does seem reasonable to feel less confidence in previous assurances with regards to China. They are not as ironclad as "threat of perjury" might suggest, at least.

Spooky23 7y ago

For Chinese users, iCloud is operated by Cloud Big Data Industrial Development Co., Ltd. My understanding is that Chinese users in mainland China have a different set of product terms that are vague or silent about certain privacy features or what the the Chinese partner does. If you are a foreigner, you use the Apple owned service. What I don’t know is where you connection terminates. With Microsoft, depending on the type of cloud, Office 365 TLS connections terminate at a local Microsoft point of presence. So you are in clear text outside of your jurisdiction for a limited period of time. (Not sure about China, but I’ve verified for other countries.) Bottom line, if I had information of interest to Chinese interests, I wouldn’t expose an account with that data there or would get real paid advice about how to do it.

29_29 7y ago
Thanks for the response, it would be great if this is the case but is this actually true? I'd like to read this from Apple, or an apple spokes person.