4 ms·

> It is my understanding that Apple has never worked with any government agency from any country to create a "backdoor" in any of our products and services. So

by cynix 7y ago

> It is my understanding that Apple has never worked with any government agency from any country to create a "backdoor" in any of our products and services. So Craig's declaration is not that they haven't created any backdoors for governments, just that he doesn't know of any.

Despegar 7y ago
That's an uncharitable reading of an extremely clear statement. And it's also understandable why it's less affirmative. He's being conservative because he can't speak for what everyone who works for him may or may not have done, for example a rogue employee. The main Apple filing is unequivocal: >Apple has never built a back door of any kind into iOS, or otherwise made data stored on the iPhone or in iCloud more technically accessible to any country’s government. The government is wrong in asserting that Apple made “special accommodations” for China (Opp. 26), as Apple uses the same security protocols everywhere in the world and follows the same standards for responding to law enforcement requests.
lern_too_spel 7y ago
Craig's declaration might have been true in 2016 when he made it. It definitely has not been true since 2018. https://www.amnesty.org/en/latest/news/2018/02/5-things-you-need-to-know-about-apple-in-china/ https://www.amnesty.org/en/latest/news/2018/02/5-things-you-...
- Despegar 7y ago
  Replying to this just for anyone else that reads this later: Tim Cook confirmed this was still the case in this 2018 interview with Vice. https://www.youtube.com/watch?v=VD1cP8SK3Q0&feature=youtu.be&t=244 https://www.youtube.com/watch?v=VD1cP8SK3Q0&feature=youtu.be...
  - vatueil 7y ago
    Transcript of relevant section: https://youtu.be/VD1cP8SK3Q0?t=244 https://youtu.be/VD1cP8SK3Q0?t=244 > VICE News: In terms of privacy as a human right, does that apply to how you do business in China? > Apple CEO Tim Cook: It absolutely does. Encryption for us is the same in every country in the world. We don't design encryption for, you know, for the US and do it differently everywhere else. It's the same. And so to send a message in China, it's encrypted. I can't produce the content. I can't produce it in the United States either. If you lock your phone in China, I can't open it. > The thing in China that some people have confused is certain countries, and China's one of them, has a requirement that data from local citizens has to be kept in China. We worked with a Chinese company to provide iCloud. But the keys, which are- which is the "key" so to speak, pardon the pun, are ours. > VICE: But haven't they moved to China, meaning it's much easier for the Chinese government to get to them? > Cook: No, I wouldn't- I wouldn't get caught up in the, uh, "where's the location" of it. I mean, we have servers located in many different countries in the world. It's- they're not easier to get data, uh, from being in one country versus the next. The key question is, how does the encryption process work, and who owns the keys if anyone. In most cases for us, you and the receiver own the keys. VICE interviews are not held under penalty of perjury, of course, but we may give Apple's CEO the benefit of the doubt. As Mr. Cook acknowledges, Apple did make significant changes to iCloud data storage for Chinese users, though he suggests in "most cases" users have control over encrypted data. The encryption angle was addressed in the article from Amnesty International as well. Since the changes to iCloud for Chinese users in 2018 postdate the court filings in 2016, it does seem reasonable to feel less confidence in previous assurances with regards to China. They are not as ironclad as "threat of perjury" might suggest, at least.
    - Despegar 7y ago
      Anyone that's expecting Apple to annually refresh their statements about this under oath to not be considered compromised is probably acting in bad faith. The first time was good enough for anyone that actually wants to know if Apple had to make compromises to be in China. The answer is no and the reason why is obvious, Apple has some leverage in being a major employer and a highly visible American company operating in China. Apple's press statements as well as that on-the-record interview with the CEO are perfectly consistent with the court filings. >Originally, iCloud data was stored on Apple-controlled servers, with the Cupertino company holding the encryption keys. Apple announced a year ago that this would change to comply with new laws in China, and that data for Chinese iCloud accounts would be moved to a server run by Guizhou-Cloud Big Data (GCBD), a company owned by the provincial government. >However, I have spoken to Apple today, who confirmed that it still holds the encryption keys, and states categorically that they have not been made available to either GCBD or China Telecom. https://9to5mac.com/2018/07/18/chinese-icloud-data-china-telecom/ https://9to5mac.com/2018/07/18/chinese-icloud-data-china-tel... And the use of mutliple zero day exploits to target the Uyghurs basically confirms that China doesn't have direct, backdoor access to Apple products.
      - lern_too_spel 7y ago
        > And the use of mutliple zero day exploits to target the Uyghurs basically confirms that China doesn't have direct, backdoor access to Apple products. Nobody claimed that the Chinese government has backdoor access to the phones themselves. They do have complete access to Chinese users' iCloud and iMessage data.
      - vatueil 7y ago
        Doesn't it also paint an incomplete picture to present Apple's reassurances as backed by penalty of perjury when the most significant developments took place long after those statements in question? The fact that the iCloud China controversy happened years after those court filings was not disclosed in the original comment. The concerns expressed by human rights groups such as Amnesty International are nothing so blatant as a direct backdoor, but the erosion of layers of protection that extend beyond technical measures. As the previously cited report notes: https://www.amnesty.org/en/latest/news/2018/02/5-things-you-need-to-know-about-apple-in-china/ https://www.amnesty.org/en/latest/news/2018/02/5-things-you-... > Apple says it has control over encryption keys and that it won't allow backdoors. Won't that protect users in China? > It all depends on the circumstances under which the company will allow GCBD – and the Chinese authorities – access to intelligible decrypted data on iCloud users. When users accept [the terms of service for iCloud in China](https://www.apple.com/legal/internet-services/icloud/en/gcbd-terms.html https://www.apple.com/legal/internet-services/icloud/en/gcbd...), they agree to allow their information and content to be turned over to law enforcement “if legally required to do so”. Significantly, from now on Apple will store the encryption keys for Chinese users in China, not in the US – making it all but inevitable that the company will be forced to hand over decrypted data so long as the request complies with Chinese law. > Given that many provisions of Chinese law offer inadequate protection to privacy, freedom of expression and other rights, simply checking whether government information requests comply with Chinese law doesn’t address whether complying with the request might contribute to human rights violations. Apple hasn’t confirmed whether or how it will assess whether government information requests might violate users’ human rights. We won't really know how Apple will respond until it's put to the test, and unfortunately that’s probably just a matter of time. > As for “backdoors”, or technical measures that would allow law enforcement or other government agencies to access unencrypted user data without having to ask for it, Apple’s commitment to prevent their use is admirable. But the commitment is meaningless if law enforcement can get the companies to decrypt user information simply by saying that it is for a criminal investigation.
  - lern_too_spel 7y ago
    Cook confuses iMessage security with iCloud security in this interview, whether on purpose or out of ignorance. Yes, only the users have the private keys in the iMessage case, but this doesn't matter in practice because Apple (or for Chinese users, China) controls the server that distributes the public keys, allowing the Chinese government to eavesdrop on any conversation involving at least one Chinese party trivially. By pretending that only where the iMessage private keys are is an issue, he also distracts the interviewer from the fact that China has gets to determine when to decrypt any Chinese user's iCloud data, which Apple itself had already confirmed to Reuters. https://www.reuters.com/article/china-apple-icloud/rpt-insight-apple-moves-to-store-icloud-keys-in-china-raising-human-rights-fears-idUSL2N1QG01R https://www.reuters.com/article/china-apple-icloud/rpt-insig...

by cynix 7y ago

Despegar 7y ago

That's an uncharitable reading of an extremely clear statement. And it's also understandable why it's less affirmative. He's being conservative because he can't speak for what everyone who works for him may or may not have done, for example a rogue employee. The main Apple filing is unequivocal: >Apple has never built a back door of any kind into iOS, or otherwise made data stored on the iPhone or in iCloud more technically accessible to any country’s government. The government is wrong in asserting that Apple made “special accommodations” for China (Opp. 26), as Apple uses the same security protocols everywhere in the world and follows the same standards for responding to law enforcement requests.

lern_too_spel 7y ago

Craig's declaration might have been true in 2016 when he made it. It definitely has not been true since 2018. https://www.amnesty.org/en/latest/news/2018/02/5-things-you-need-to-know-about-apple-in-china/ https://www.amnesty.org/en/latest/news/2018/02/5-things-you-...

Despegar 7y ago
Replying to this just for anyone else that reads this later: Tim Cook confirmed this was still the case in this 2018 interview with Vice. https://www.youtube.com/watch?v=VD1cP8SK3Q0&feature=youtu.be&t=244 https://www.youtube.com/watch?v=VD1cP8SK3Q0&feature=youtu.be...
- vatueil 7y ago
  Transcript of relevant section: https://youtu.be/VD1cP8SK3Q0?t=244 https://youtu.be/VD1cP8SK3Q0?t=244 > VICE News: In terms of privacy as a human right, does that apply to how you do business in China? > Apple CEO Tim Cook: It absolutely does. Encryption for us is the same in every country in the world. We don't design encryption for, you know, for the US and do it differently everywhere else. It's the same. And so to send a message in China, it's encrypted. I can't produce the content. I can't produce it in the United States either. If you lock your phone in China, I can't open it. > The thing in China that some people have confused is certain countries, and China's one of them, has a requirement that data from local citizens has to be kept in China. We worked with a Chinese company to provide iCloud. But the keys, which are- which is the "key" so to speak, pardon the pun, are ours. > VICE: But haven't they moved to China, meaning it's much easier for the Chinese government to get to them? > Cook: No, I wouldn't- I wouldn't get caught up in the, uh, "where's the location" of it. I mean, we have servers located in many different countries in the world. It's- they're not easier to get data, uh, from being in one country versus the next. The key question is, how does the encryption process work, and who owns the keys if anyone. In most cases for us, you and the receiver own the keys. VICE interviews are not held under penalty of perjury, of course, but we may give Apple's CEO the benefit of the doubt. As Mr. Cook acknowledges, Apple did make significant changes to iCloud data storage for Chinese users, though he suggests in "most cases" users have control over encrypted data. The encryption angle was addressed in the article from Amnesty International as well. Since the changes to iCloud for Chinese users in 2018 postdate the court filings in 2016, it does seem reasonable to feel less confidence in previous assurances with regards to China. They are not as ironclad as "threat of perjury" might suggest, at least.
  - Despegar 7y ago
    Anyone that's expecting Apple to annually refresh their statements about this under oath to not be considered compromised is probably acting in bad faith. The first time was good enough for anyone that actually wants to know if Apple had to make compromises to be in China. The answer is no and the reason why is obvious, Apple has some leverage in being a major employer and a highly visible American company operating in China. Apple's press statements as well as that on-the-record interview with the CEO are perfectly consistent with the court filings. >Originally, iCloud data was stored on Apple-controlled servers, with the Cupertino company holding the encryption keys. Apple announced a year ago that this would change to comply with new laws in China, and that data for Chinese iCloud accounts would be moved to a server run by Guizhou-Cloud Big Data (GCBD), a company owned by the provincial government. >However, I have spoken to Apple today, who confirmed that it still holds the encryption keys, and states categorically that they have not been made available to either GCBD or China Telecom. https://9to5mac.com/2018/07/18/chinese-icloud-data-china-telecom/ https://9to5mac.com/2018/07/18/chinese-icloud-data-china-tel... And the use of mutliple zero day exploits to target the Uyghurs basically confirms that China doesn't have direct, backdoor access to Apple products.
    - lern_too_spel 7y ago
      > And the use of mutliple zero day exploits to target the Uyghurs basically confirms that China doesn't have direct, backdoor access to Apple products. Nobody claimed that the Chinese government has backdoor access to the phones themselves. They do have complete access to Chinese users' iCloud and iMessage data.
    - vatueil 7y ago
      Doesn't it also paint an incomplete picture to present Apple's reassurances as backed by penalty of perjury when the most significant developments took place long after those statements in question? The fact that the iCloud China controversy happened years after those court filings was not disclosed in the original comment. The concerns expressed by human rights groups such as Amnesty International are nothing so blatant as a direct backdoor, but the erosion of layers of protection that extend beyond technical measures. As the previously cited report notes: https://www.amnesty.org/en/latest/news/2018/02/5-things-you-need-to-know-about-apple-in-china/ https://www.amnesty.org/en/latest/news/2018/02/5-things-you-... > Apple says it has control over encryption keys and that it won't allow backdoors. Won't that protect users in China? > It all depends on the circumstances under which the company will allow GCBD – and the Chinese authorities – access to intelligible decrypted data on iCloud users. When users accept [the terms of service for iCloud in China](https://www.apple.com/legal/internet-services/icloud/en/gcbd-terms.html https://www.apple.com/legal/internet-services/icloud/en/gcbd...), they agree to allow their information and content to be turned over to law enforcement “if legally required to do so”. Significantly, from now on Apple will store the encryption keys for Chinese users in China, not in the US – making it all but inevitable that the company will be forced to hand over decrypted data so long as the request complies with Chinese law. > Given that many provisions of Chinese law offer inadequate protection to privacy, freedom of expression and other rights, simply checking whether government information requests comply with Chinese law doesn’t address whether complying with the request might contribute to human rights violations. Apple hasn’t confirmed whether or how it will assess whether government information requests might violate users’ human rights. We won't really know how Apple will respond until it's put to the test, and unfortunately that’s probably just a matter of time. > As for “backdoors”, or technical measures that would allow law enforcement or other government agencies to access unencrypted user data without having to ask for it, Apple’s commitment to prevent their use is admirable. But the commitment is meaningless if law enforcement can get the companies to decrypt user information simply by saying that it is for a criminal investigation.
- lern_too_spel 7y ago
  Cook confuses iMessage security with iCloud security in this interview, whether on purpose or out of ignorance. Yes, only the users have the private keys in the iMessage case, but this doesn't matter in practice because Apple (or for Chinese users, China) controls the server that distributes the public keys, allowing the Chinese government to eavesdrop on any conversation involving at least one Chinese party trivially. By pretending that only where the iMessage private keys are is an issue, he also distracts the interviewer from the fact that China has gets to determine when to decrypt any Chinese user's iCloud data, which Apple itself had already confirmed to Reuters. https://www.reuters.com/article/china-apple-icloud/rpt-insight-apple-moves-to-store-icloud-keys-in-china-raising-human-rights-fears-idUSL2N1QG01R https://www.reuters.com/article/china-apple-icloud/rpt-insig...