19 ms·

Apple pays out millions to student after repair techs shared her personal images

474 points by hownottowrite 5y ago

wil421 5y ago
A decade ago I can remember forums suggesting you take out your hard drive out of your Mac when you send it in for repair. Part of the reason was privacy and the other part was user upgraded RAM or HD being removed by the repair techs and you getting billed for it. I believe there was another case where the FBI was getting Best Buy’s Geek Squad repair centers to report CP.
- sgtnoodle 5y ago
  I sent in a laptop once to Best Buy that came back with a smaller hard drive. I think it is likely that a local employee swapped it before sending it into the real repair facility.
- ratww 5y ago
  I once tried checking in a MacBook Air without SSD once at a 3rd-party authorized repair center, and they flat out refused to repair once they noticed the SSD was missing, and said Apple would "blacklist" me from any future repair. I communicated this to Apple and while Apple apologized profusely to me, and even paid for the new battery and repair (I didn't ask for it, it was out of warranty for 5 years), but I still never trusted third-party repairers again... that put off buying new Apple stuff until I became able to move to a place with an Apple Store. I'm happy to say however that I never had this problem going to the Apple Store in Berlin, but not everyone lives in a big city with one of those.
  - wil421 5y ago
    Agreed. The Apple Stores in the US are good with repairs but once you have to send it to a repair center you might have issues.
  - martin_a 5y ago
    > I'm happy to say however that I never had this problem going to the Apple Store in Berlin I visited the store in Augsburg once (although... is that an official dealership?) and they wanted to keep my work MBP for two weeks while repairing it. As it was a new one (butterfly keyboard broken) you could not remove the HDD/SSD, I think. Took it back with me again, keyboard stayed unrepaired for as long as I worked with that company.
    - ratww 5y ago
      The Butterfly keyboard MBs are a PITA to disassemble. I just got a new M1 Air and while I have no idea how bad it is, I still keep two accounts (one empty for repair, one encrypted and backed up for me) just in case, although it seems Apple itself doesn't ask the password... since I don't think I can't remove the SSD myself :/
  - kergonath 5y ago
    > and said Apple would "blacklist" me from any future repair. This sounds highly illegal. Also, why would Apple care? I can see how repair shops could want that, but I don’t get the thought process that would lead to this becoming Apple’s policy. I would not trust these people anymore either.
    - deleted 5y ago
      [deleted]
  - delfinom 5y ago
    Don't blame the repair ship. Apple legitimately runs draconian level control over repair shops that partner with them. They want to follow the rules to the T or Apple will drop them. They more than like misconstrued the rules.
- grishka 5y ago
  > user upgraded RAM or HD being removed by the repair techs and you getting billed for it. I'd call that a theft.
- gambiting 5y ago
  >>I believe there was another case where the FBI was getting Best Buy’s Geek Squad repair centers to report CP. I mean, that sounds great in principle, except that I do remmeber reading about a case where they reported some older dude for having CP on his laptop, and it took him being arrested and fired from his job and obiously smeared in every newspaper possible, before prosecutor finally looked at the pictures and figured that yes, indeed, the "CP" in question was just pictures of his grandchildren in a pool with other family around.
iamricks 5y ago
Reminder that when you take in a phone to get repaired you should back up the phone and erase all of its data. I feel like this type of stuff is common in smaller repair shops.
- javierbyte 5y ago
  If your phone is broken you don't always have the option to do that.
  - nytesky 5y ago
    Won't iCloud lost mode and remote erase mostly accomplish that? Not sure how many photos are cached on the phone in off-line mode, but that would remove icloud photo access at least.
    - michaelt 5y ago
      Fine advice if you already had your phone entirely backed up before it broke. But if your phone's broken and you know you don't have complete backups, I can understand being hesitant to hit the remote wipe button.
      - kergonath 5y ago
        Yeah, regular backups is a must.
- Someone1234 5y ago
  - If your phone is broken that may not be an option. - The victim isn't responsible for the crime committed against them, as shown by this verdict. - It is common because it is under-prosecuted. Hopefully we can see changes there.
  - beagle3 5y ago
    > The victim isn't responsible for the crime committed against them, as shown by this verdict. The victim isn't responsible, but often the damage really is irreparable, and you don't even know who is the criminal (your private photos are online. Now what?), so it's a good idea to make the crime less likely to happen. As always, it's an effort-benefit tradeoff.
Someone1234 5y ago
This is one area where there are technological solutions to people problems. Namely, that currently an iOS device needs to be fully unlocked to be services but realistically there should be something between "service access" and "full unrestricted access to a customer's PII and app state." Keep in mind that in iOS root is rarely available, so even when servicing devices they're manipulating the OS via a restricted service interface that can only perform certain actions (e.g. wipe, re-flash, test different components, etc). I cannot access the original article, but I am hoping criminal charges were also utilized as this is unlawful in many states (and frankly should be national).
- pradn 5y ago
  There should also be audit logs recorded by the device and sent to the user's Apple account. So you can see which apps, screens, and data a service person used. This is a routine ask from companies to cloud providers, for example.
  - davisr 5y ago
    Ah, yes, more surveillance is surely the answer.
    - CobaltFire 5y ago
      Of technicians accessing a device that is that personal and many people consider secure due to Apple's own marketing? Absolutely.
    - MikeDelta 5y ago
      Logging is not necessarily surveilance. It is about you seeing what they do with your phone.
      - deleted 5y ago
        [deleted]
    - deleted 5y ago
      [deleted]
KMnO4 5y ago
I couldn’t find the exact number of “millions” that Apple paid. Is it part of a class action lawsuit or did the entirety go to the one plaintiff? It amazes me that workplace conditions causing loss of life can be settled for much, much less (as low as $75k paid to the family).
- IG_Semmelweiss 5y ago
  I am not going to make a judgement on the morality, but this is not surprising. Awards for loss of life are actually codified in case law as being vastly smaller awards than the award for loss of limbs, senses, etc. It is somewhat logical since the primary injured (the dead) can't be made whole. Contrast this to someone injured but not dead - they will have to live with the injury for the rest of their life. Case in point - this girl. This is why disability policies are more expensive for higher income individuals. Presumably, the injured and his/her family depends on that income to live, and the income loss must be made whole.
  - wallacoloo 5y ago
    > they will have to live with the injury for the rest of their life. Case in point - this girl. I’m conflicted in taking this side, but if it’s millions — with an s — given just to her, then she’s basically set for life. Never has to work again to maintain a decent middle-class life, because her FB friends saw her nudes. That seems wildly disproportionate — most everyone I know would gladly take that trade. If it’s a class action suit, or is constructed such that not all that money goes to this one victim, that’s a different thing. The part that disturbs me is whenever being a victim can become similar to winning the lottery.
    - muskox2 5y ago
      I'm sure in any case the lawyers took a hefty sum.
    - mlac 5y ago
      It’s easy to say “hey sorry network, you’re going to some explicit photos of me and I’m gonna make millions from it. Just ignore it and we’re good”. But that wasn’t the deal. This feels a bit like the McDonald’s coffee lawsuit. On the surface it’s easy for some to take that deal (nudes for millions) but consider this: 1) she might have been Facebook friends with family or family friends. 2) this could wreck someone in high school and cause issues with dating, friends, etc. taken the wrong way it could kill your social life and cause depression 3) people jump to assuming she’s conventionally attractive. She might be very shy about her body and was taking those for herself. People might have grabbed them and made fun of her.. 4) there was no guarantee of a payout and it took five years legal distraction during prime high school and college age for a resolution 5) if she is from a small town or a highly religious town, she will now be known as the girl that had her nudes leaked. If it was a religious town, it could have brought shame on the family and in some cases ended relationships 6) if this screwed up her high school trajectory, it could have messed up her grades and limited her college choices Lastly, I think part of this amount is to make it somewhat meaningful to Apple. If it happened once because they didn’t properly vet their 3rd party, a small fine would do nothing to prevent it from happening in the future.
perryizgr8 5y ago
I don't understand why they need to unlock the phone for hardware repairs. I took my Toshiba laptop for a motherboard replacement after a power surge, and never provided my password. They gave it back after the repair and the OS was literally untouched. I would think Apple with their trillions would have figured out proper hardware repairs by now?
- dagw 5y ago
  It's really easy to boot up a computer to a different OS installed on a different storage medium to test the hardware. Phones don't have the option.
  - ysleepy 5y ago
    Phones actually do have that option. Android bootloader supports fastboot boot of an image file on the host PC, usually a recovery ROM. Apple is certainly capable to do that and I'm even sure that this exists on their devices too.
- pcdoodle 5y ago
  Unauthorized iPhone repair company here, We like to test the microphones and any other components that can be disturbed by the repair.
  - kergonath 5y ago
    Way to go. I wish the guy who repaired my girlfriend’s iPhone a couple of years ago had done as well. What a cock up that was.
- Someone1234 5y ago
  Hardware requirements/differences mostly. With the laptop example they can pull the storage medium (2.5" HDD/SSD, or NVMe), service it, and then reinstall. Whereas iOS devices have storage soldered onto the mainboard and there's a cryptographic sync between the T2 chip and OS installation, so you cannot simply swap the storage onto a different phone (this is actually a legitimate security feature that just happens to hurt service-ability also). I believe there are things they can do (different levels of access, managed by iOS) but the laptop analogy doesn't help here since it is an Apples and Grapefruit kinda comparison.
boleary-gl 5y ago
I wonder how many times this has happened and they didn't find out about it. Posting it to her own Facebook made it pretty obvious. My father was an accountant for many years and he always said if you found evidence of fraud you shouldn't be congratulatory because what you found is maybe 10% of what is actually there if you found it by chance.
- thatguy0900 5y ago
  Happens a lot. I used to work at a att store, workers getting into trouble for saving pics off customer phones happened regularly. I remember it going around that a verizon(? I think,it was a while ago) employee ring got busted for having a shared Dropbox full of pics from multiple stores and all of our managers were on guard about it happening at att.
- Cthulhu_ 5y ago
  I feel like that's the case with most solved crimes, e.g. drug smuggling; they are proud of catching big shipments, but if the shipments are that big already it implies that it's only the tip of the iceberg, as in, don't put all your eggs in one basket.
- smcl 5y ago
  This came up in Ozark too (good series) someone busts an employee stealing something and isn’t sure what to do, gets the advice “Fire her. It’s not the first time she stole from you. It’s the first time you caught her.”
- hellbannedguy 5y ago
  I worked as a state security guard while I was going to school. It was a good gig because I could get all my homework done while working, and state law said my pay needed to be equal to full time employees. My boss took his job very serious. He got the state to send us to security seminars. This was the late 80's and what suprised me the most is whom steals, or commits financial fraud. At least back then most loss in retail was committed by management. The higher up the tree, the more they stole be it cash, or merchandise. The employees, and customers stole, but the big thefts were usually committed by long term trusted management types. The instructor said, employees/owners usually don't question management, and they have more opportunities alone, with no one watching. He also said owners were notorious for stealing their stuff, and writing it off, or claiming it as a loss through their insurance company. He said, this is a dirty secret, that most organizations don't want leaked. It's much easier to blame the homeless, or gangs on theft. I imagine that has changed with the proliferation of cameras everywhere, but when I gear about large scale theft in a corporation, I automatically look at those in command of the employeees. My local Goodwill had gone through three store managers in a row for embezzlement. This was years ago though. Goodwill never prosecutes employees because they don't want to tarnish their image.
zamalek 5y ago
Didn't Apple testify that allowing third-party repairs would risk user security/privacy? If Apple can't be trusted either, and has to be sued before making things right, isn't the testimony superfluous? This another example why nudes and so forth should never make it onto a digital device. If that's your kink, then Polaroid cameras and camcorders exist.
- fastball 5y ago
  Or just keep sensitive things in an encrypted container. Pretty easy to set up an encrypted sparsebundle on a mac for all your naughty photo needs!
- wongarsu 5y ago
  > If that's your kink, then Polaroid cameras and camcorders exist. That sounds a bit like the Onion sketch "Google allows you to opt-out of tracking by moving to remote mountain village" [1]. This case proves that the criminal justice system works to protect your personal images, we just need a better way to be notified when it happens (the kind of action you would expect Apple to take if they cared, instead of "we continued to strengthen our vendor protocols") 1: https://www.youtube.com/watch?v=lMChO0qNbkY https://www.youtube.com/watch?v=lMChO0qNbkY
  - khuey 5y ago
    The story doesn't mention anything about any criminal charges. The only reason they got caught is because they uploaded the pictures/videos to her Facebook. If they had sent them to a porn site instead they would have gotten away with it. The grandparent is largely correct, if sexually explicit photos/videos of you make it onto a digital device controlling their distribution is difficult at best.
- emsy 5y ago
  This should be the top voted commen. This is similar to their claims about App Store security, on which they continuously fail to deliver. They want absolute control but don't give you absolute security and they are only ever liable if you take them to court personally (and who wants to take the worlds biggest company to court really?).
qrbLPHiKpiux 5y ago
I took my MacbookPro to an Apple store to have the keyboard replaced. I dropped it off. They called me later that day saying it was almost ready to be picked up, but they needed the bios password. I asked what for. They said they need to check the function. I said that defeats the purpose of the bios password. (o_O) I did not give it and they said if there were any problems to bring it back.
dqpb 5y ago
Breaking News: trusted authority can’t be trusted.
throwaway10474 5y ago
They get mad when you show up at the apple store for service having just reset the phone. “We take privacy seriously”, “you can trust us us”, blah blah blah. No. Always fully wipe before handing your phone or laptop over to anyone you don’t know and trust.
- kergonath 5y ago
  > They get mad when you show up at the apple store for service having just reset the phone. They don’t. I’ve done it several times with my old MBP and a couple of iPhones. I never leave a device with a technician without wiping it first. If someone gets upset about that, the proper thing to do is escalate with the manager, because that would be highly irregular.
fortran77 5y ago
We're running out of options here. Both Apple and Google are fatally flawed companies. I think I may go back to using a feature phone.
teekert 5y ago
I once brought my MBP 15" Early 2011 into an Apple store (or maybe an authorized reseller? For that GPU snafu), they wanted the admin password with it... ugh I felt dirty giving them that. Just boot from stick to test the hardware, leave my hdd/ssd alone!
- asdff 5y ago
  Eventually they stopped booting into your account and now they plug in whatever computer they get into the store's intranet and boot off their images. I'm surprised it took them years to do that, though.
marcodiego 5y ago
I remove any media from my computers when I send to a repair shop. If any media fails, it should be destroyed. If you ever sells storage media, dd if=/dev/zero it; also consider that it may not be enough with some wear leveling SSD's. A few years ago, someone bought an used harddisk and got some private information of Brazil's then first lady Marcela Temer[0] and tried to blackmail her. He was later caught and imprisoned, but not everybody has the same luck. [0] http://g1.globo.com/tecnologia/noticia/2016/10/hd-comprado-ha-8-anos-e-pivo-da-clonagem-do-celular-de-marcela-temer.html http://g1.globo.com/tecnologia/noticia/2016/10/hd-comprado-h...
- alekratz 5y ago
  > dd if=/dev/zero it or `shred` it. Probably takes longer but more secure.
  - wang_li 5y ago
    /dev/zero is perfectly fine for modern high density drives. If the drive in question is MFM or RLL from the '80s or '90s, then absolutely go bananas with 53 different bit patterns. But otherwise zeros is effective for nay hard drive made in the last decade. SSD has issues with wear leveling, so good luck wiping those. Though you're only going to have to worry about someone who is willing to disassemble the SSD device and read the chips individually.
- megous 5y ago
  It helps if you never store unencrypted data on the drive.
yawaworht1978 5y ago
I wonder how often this happens in unlicenced repair junkyard shops. Sometimes they ask for the main login pwd for no good reason.
- topspin 5y ago
  Privacy violations are one of the floats in the Parade Of Horribles that Apple el al. offer when attempting to defend their repair monopoly. Guess that argument is out the window.
  - rantwasp 5y ago
    whoa whoa. no system is perfect. just because this happened does not make it the SOP.
    - saurik 5y ago
      And yet I trust "Cupertino iPhone Repair" (my go to third-party repair people, in whom I have quite a lot of trust) or "Shakeel the iPhone Repair Guy" (that is a legit place I have multiple friends who highly recommend, though I haven't used him personally; I have, however, heard detailed stories of his process) more than this process from Apple on this matter of data privacy (and always have: this story has changed nothing for me except help me prove to others how careful you have to be) as my chosen third-party repair people will repair my phones while I wait--often in front of me (making it quite difficult to screw with me very much)--and notably don't ask me for my passcode. If Apple's system isn't, in fact, perfect--or at least nearly so--then they can't continue to morally justify their monopoly on grounds of "but everyone else is dangerous!! only we can be trusted!!" (not that that should allow their behavior anyway, but it isn't even a legitimate defense).
      - rantwasp 5y ago
        i have literally never been asked for a password by apple when I had issues. I unlocked my phone myself when they needed to look at something and they looked at it only while I was present. If they needed to take the phone “in the back” I made sure it was locked (this was for a screen replacement) or I simply wiped it when it had an issue that needed replacement.
kossTKR 5y ago
I've experienced that repair shops ask "and your password and username is?", many times when handing over my laptop - and i'm always like "what, no i'm not giving you my password" resulting in them looking surprised. Who the on earth gives their passwords, also all laptops should be encrypted by default. I find it absurd to give away the keys to your bank, search history, personal notes, images, whatever - it's beyond private and personal besides being economically dangerous and very bad job security wise for most jobs. Not blaming regular people though, but it's weird that people are so lax about giving the keys to absolutely everything.
- Sebb767 5y ago
  I feel this is a bit like popping your hood at the car shop, but taking your key with you. I can absolutely see why repair shops would want to verify that a) it's not a software problem and b) everything still works fine afterwards, both of which is hard w/o the password. Sure, you can send in a wiped device or a device without hard drive - and if you can do so yourself, this is probably fine. But for the "average" user it's quite likely a better experience, assuming you can trust the repair shop - but then again, they have full access to your hardware plus the knowledge and time to permanently bug your device. If you really don't trust them, you probably should not give them your device at all. I can see the issue here and I'd probably err on the side of privacy given the choice, but the other side has a point.
  - baby 5y ago
    They can do this from a guest account. Full disk encryption will protect your data.
    - Sebb767 5y ago
      No, it won't. They could simply put in a different BIOS chip, which records you password the next time you enter it. Or a malicious RAM chip that injects a virus at runtime and extract your data that way. Or a bugged keyboard that transmits your key presses, combined with a full copy of your disk ... Sure, it's a bit more sophisticated than Ctrl+C/Ctrl+V. But if you're running a computer repair shop, it is quite likely that you have a good amount of technical knowledge. If someone has hardware access, you can usually see your device as compromised - especially if they have a lot of time and are expected to open up the device.
princevegeta89 5y ago
Why would she even hand over her phone to them while she knew there were explicit photos and videos of her in it?
- Tepix 5y ago
  Some defects will prevent you from erasing the phone before giving it to a repair center.
- andreime 5y ago
  your question reads like you're saying it's the victim's fault
  - josefresco 5y ago
    It's not, but it's still careless or slightly reckless behavior. Like leaving a pile of valuables on the front seat of your unattended (but locked) car.
    - Natfan 5y ago
      That analogy doesn't really work here, because then anyone who's walking past could steal the valuables in your car. Consider that you had to send your car in for repairs to the company that produced your car, and you placed some valuables in your (locked) glove compartment. They then steal all of your valuables. The car company (or their trained engineers) should never have to entered the glove compartment at all. The fact of the matter is that you left your valuables in your car with a trusted third party, and that trust was abused and your valuables were stolen. The issue isn't that someone stole your stuff, it's that you trusted the company that built your car to not go snooping around and stealing your stuff. Trusting a third party is not "careless or "reckless" behaviour, the onus is on the company to behave responsibly with your personal items/data. EDIT: I took a look at the original article from the Telegraph[0], and it seems like the perpetrators were an Apple contractor called "Pegatron". While this isn't as bad as a BMW employee stealing stuff from a locked compartment in your BMW car, it still isn't great. If this contractor was officially allowed to perform repairs (which it seems like they were, as Apple paid the lawsuit), then they should be held to the same standards as Apple employees when it comes to data privacy. [0]: https://archive.ph/WFaO9 https://archive.ph/WFaO9
beckman466 5y ago
Talented business consultant Nathan Fielder covered this topic not long ago. I believe he was the first one to spot this gap in the market for an asexual computer repair service. He actually shares his findings with us here: https://www.youtube.com/watch?v=jf9I04Oa-hU https://www.youtube.com/watch?v=jf9I04Oa-hU "Nothing is more powerful than an idea whose time has come."
- yosito 5y ago
  I know there is historical precedent for royals trusting eunuchs with things they can't trust to horny men, but these days I'd be very skeptical of any repair service saying "Don't worry, you can trust us because we're asexual". This is like a priest saying, don't worry you can trust me not to be tempted by anything "sinful" because I'm a priest. Information security is not just about sex. I'd rather trust a computer repair service that passes third party security audits and is verfiably secure. The sexuality of employees is none of my business.
  - WFHRenaissance 5y ago
    The genius of business consultant Nathan Fielder is that his empathy for the consumer is near-unlimited. Sure, you may have some opposition to the methods at use in the above consultation, but it put customers at ease. He saw the market before it existed. He put the customers first, and it worked. We can all learn something here I think.
    - Sebb767 5y ago
      That's not the point the previous comment made, I think. It's not that you could not trust asexual people to be calmer in this regard, but someone willing to sniff and publish your private data is probably not going to be afraid to lie to you when you ask whether they are asexual.
      - Sholmesy 5y ago
        While the thought process here is sound, and I agree with you, watching the video will probably reveal that national treasure Nathan Fielder is also a part-time comedian alongside being an exceptional business consultant.
diehunde 5y ago
Why would they do that? I mean what was the point of posting the pictures to her own account?
- wonderwonder 5y ago
  Cruelty is the point
arthur_sav 5y ago
I went to an Apple certified repair shop to fix my macbook. They asked me for my login password... Sure let me just give access to all my banking apps, photos, browser sessions etc... I ended up creating a guest account for them but i was surprised they didn't have a policy not to access private user data or ask for passwords.
- fernandotakai 5y ago
  funny -- when i had to service my old macbook, the repair shop asked for a guest account since they didn't want access to my stuff.
cvwright 5y ago
Title doesn't tell the half of it. "Personal images" are photos of your kids playing in the backyard, or dinner with your extended family. What they stole here was much more intimate than that.
- hownottowrite 5y ago
  There's only so much room in the title.
  - saagarjha 5y ago
    Perhaps "intimate images" would work?
mymythisisthis 5y ago
Shouldn't the technician be charged with sexual abuse, and face jail time?
- wonderwonder 5y ago
  100% Surprised they were not arrested or no charges were filed. (or at least the article did not mention it)
ArkanExplorer 5y ago
Given the millions paid out for essentially the malpractice of these technicians, is it possible in another scenario that a 'victim' and technicians collude to repeat the same outcome, and split the court winnings? The technicians remain nameless, and suffer no reputational damage, just losing their jobs. Put another way - how is Apple actually responsible for the activities of these individual technicians?
- wang_li 5y ago
  Congress does this as well. They pay out millions in sexual harassment claims to staff and they never name the people involved. What should happen here is the technician should be named, there should be big billboards put up in whatever town they live in, and they should have to get "I distributed child porn" tattooed on their face. As well as not be allowed to come within 50 yards of a computer or cell phone or transistor. There are harms you can't undo and the punishment should be as permanent as the harm.
phkahler 5y ago
A Facebook friend posted about getting a new phone. It was one of the last posts before someone tried to fish me through FB messenger posing as her. I reached out to her father, brother, and one friend that she posted pictures with - all people that know her IRL. All 3 appear to be compromised. I keep thinking this may have started with her old phone getting in the wrong hands.
Natfan 5y ago
Just to clarify, the article states that the victim is 21, and that the offence occurred in 2016. Does this mean that she was a minor at the time, and if so was the sharing of these images as similar crime to distributing child pornography?
- TigeriusKirk 5y ago
  Facebook presumably knew her age and has filters for nudity. I'm surprised they didn't catch it.
- LorenPechtel 5y ago
  But is that 21 now, or 21 in 2016 when the offense was committed?
dathinab 5y ago
It's kinda funny that Apple denounced 3rd party repairs with "because they could misuse your data" while (proper) 3rd parity repair shops normally don't ask for you password and in turn can't access the phones data after it had been shut down once. I'm more irritated that a Apple repair shop asked for login information then that a repair person with login information abused them (which sadly isn't surprising).
ezoe 5y ago
Seriously unless it's OS filesstem corrupted, Apple has no need to decrypt the user storage. If they can't do that, it just mean their design of the computer is horrible. I get that people need fancy thin phone, but storage and battery shall be removable. The only workaround as of now is not to own a phone which I exercise. I can't trust any of them.
s1artibartfast 5y ago
The article doesn't specify if the sharing of photos was intentional or not. There should be safeguards either way, but it seems that most articles and posters are assuming that it was. I can imagine a number of ways to accidentally or automatically sync photo albums to Facebook, and this is one of the main reasons I don't have it on my phone. Similarly, if the privacy breach was intentional, I would have guessed the techs would have downloaded the content and done something that was less obviously traceable to them.
- xkjkls 5y ago
  Seems pretty obvious it was intentional. The amount of planets to align for a repair tech to accidentally post 10 nude photos to Facebook is greater than the number in the Solar System.
  - hollerith 5y ago
    What seems most likely to me is that the tech or techs intentionally viewed the pics, but while doing so unintentionally uploaded to Facebook.
- ljm 5y ago
  How do you unintentionally open someone's FB app and then unintentionally go to submit a post, and then unintentionally open the photo gallery and unintentionally attach a select few nude pics before unintentionally confirming the selection and unintentionally submitting the post? Perhaps more than once? I don't recall FB having a mechanism to automatically sync your camera roll to your FB feed. Or do you mean to suppose they thought they were on there own FB account and expected to send the pics to themselves?
  - s1artibartfast 5y ago
    That's one of the reasons I brought it up. I thought there were setting to upload the camera roll or back it up to FB without ever going into FB itself. I'm not a FB user any more, so I can't confirm something like this: https://www.dpreview.com/news/5620765515/facebook-photo-sync-auto-upload https://www.dpreview.com/news/5620765515/facebook-photo-sync...
exabrial 5y ago
Besides being fired, is the individual facing charges?
EvilEy3 5y ago
So where are the pictures?
nomoreplease 5y ago
> In a statement to The Telegraph, Apple said “when we learned of this egregious violation of our policies at one of our vendors in 2016, we took immediate action and have since continued to strengthen our vendor protocols.” Yet it took us 5 years to figure out how to make this right with the victim.
tsjq 5y ago
How many of those millions goes to the lawyer?
vinni2 5y ago
> One of the issues here is that Apple instructs customers to send in their iPhone with the passcode disabled, which allows anyone in the chain to access any data stored on the device. This right here is the problem. Apple must not ask people to turn off passcode instead reset iPhone.
- acchow 5y ago
  Surely this isn't still Apple's policy in 2021? Doesn't seem to fit their privacy-first model.
  - singlow 5y ago
    My irony detector is not giving me a clear reading...
tgsovlerkhgsel 5y ago
I wonder what (if anything) the repair techs thought when doing it. If a disgruntled employee wanted to maximize damage to the company (without regard to personal consequences), this surely looks like one of the ways to do it. I think it's still more likely that they just did it because they found it funny, but this is a kind of insider risk for companies that is really hard to defend against.
WalterBright 5y ago
I'm not sure why the actual people who did this aren't held accountable instead.
contingencies 5y ago
Possibly one of the shortest and most successful modeling careers ever? Well done to the student. Now she is undoubtedly hot, young and rich.
bacan 5y ago
Another reason to support right to repair
ashtonkem 5y ago
Shouldn’t the workers who stole those photos be prosecuted criminally?
nsajko 5y ago
Maybe this thread should be merged with https://news.ycombinator.com/item?id=27420044 https://news.ycombinator.com/item?id=27420044
nirav72 5y ago
looks like IOS needs some kind of valet key feature...
ChrisArchitect 5y ago
Fair she got a settlement but immediate reaction to this report was it sounds like automatic facebook uploading? Like it's pretty crazy the techs went to trouble of uploading, but if her account was logged in/app logged in (as most are) then even a small adjustment to settings as far as what folders to upload etc might have triggered? Not saying it wasn't malicious, likely was, but man, seems like could also be an accident of resetting settings etc

474 points by hownottowrite 5y ago

A decade ago I can remember forums suggesting you take out your hard drive out of your Mac when you send it in for repair. Part of the reason was privacy and the other part was user upgraded RAM or HD being removed by the repair techs and you getting billed for it. I believe there was another case where the FBI was getting Best Buy’s Geek Squad repair centers to report CP.

sgtnoodle 5y ago
I sent in a laptop once to Best Buy that came back with a smaller hard drive. I think it is likely that a local employee swapped it before sending it into the real repair facility.
ratww 5y ago
I once tried checking in a MacBook Air without SSD once at a 3rd-party authorized repair center, and they flat out refused to repair once they noticed the SSD was missing, and said Apple would "blacklist" me from any future repair. I communicated this to Apple and while Apple apologized profusely to me, and even paid for the new battery and repair (I didn't ask for it, it was out of warranty for 5 years), but I still never trusted third-party repairers again... that put off buying new Apple stuff until I became able to move to a place with an Apple Store. I'm happy to say however that I never had this problem going to the Apple Store in Berlin, but not everyone lives in a big city with one of those.
- wil421 5y ago
  Agreed. The Apple Stores in the US are good with repairs but once you have to send it to a repair center you might have issues.
- martin_a 5y ago
  > I'm happy to say however that I never had this problem going to the Apple Store in Berlin I visited the store in Augsburg once (although... is that an official dealership?) and they wanted to keep my work MBP for two weeks while repairing it. As it was a new one (butterfly keyboard broken) you could not remove the HDD/SSD, I think. Took it back with me again, keyboard stayed unrepaired for as long as I worked with that company.
  - ratww 5y ago
    The Butterfly keyboard MBs are a PITA to disassemble. I just got a new M1 Air and while I have no idea how bad it is, I still keep two accounts (one empty for repair, one encrypted and backed up for me) just in case, although it seems Apple itself doesn't ask the password... since I don't think I can't remove the SSD myself :/
- kergonath 5y ago
  > and said Apple would "blacklist" me from any future repair. This sounds highly illegal. Also, why would Apple care? I can see how repair shops could want that, but I don’t get the thought process that would lead to this becoming Apple’s policy. I would not trust these people anymore either.
  - deleted 5y ago
    [deleted]
- delfinom 5y ago
  Don't blame the repair ship. Apple legitimately runs draconian level control over repair shops that partner with them. They want to follow the rules to the T or Apple will drop them. They more than like misconstrued the rules.
grishka 5y ago
> user upgraded RAM or HD being removed by the repair techs and you getting billed for it. I'd call that a theft.
gambiting 5y ago
>>I believe there was another case where the FBI was getting Best Buy’s Geek Squad repair centers to report CP. I mean, that sounds great in principle, except that I do remmeber reading about a case where they reported some older dude for having CP on his laptop, and it took him being arrested and fired from his job and obiously smeared in every newspaper possible, before prosecutor finally looked at the pictures and figured that yes, indeed, the "CP" in question was just pictures of his grandchildren in a pool with other family around.

iamricks 5y ago

Reminder that when you take in a phone to get repaired you should back up the phone and erase all of its data. I feel like this type of stuff is common in smaller repair shops.

javierbyte 5y ago
If your phone is broken you don't always have the option to do that.
- nytesky 5y ago
  Won't iCloud lost mode and remote erase mostly accomplish that? Not sure how many photos are cached on the phone in off-line mode, but that would remove icloud photo access at least.
  - michaelt 5y ago
    Fine advice if you already had your phone entirely backed up before it broke. But if your phone's broken and you know you don't have complete backups, I can understand being hesitant to hit the remote wipe button.
    - kergonath 5y ago
      Yeah, regular backups is a must.
Someone1234 5y ago
- If your phone is broken that may not be an option. - The victim isn't responsible for the crime committed against them, as shown by this verdict. - It is common because it is under-prosecuted. Hopefully we can see changes there.
- beagle3 5y ago
  > The victim isn't responsible for the crime committed against them, as shown by this verdict. The victim isn't responsible, but often the damage really is irreparable, and you don't even know who is the criminal (your private photos are online. Now what?), so it's a good idea to make the crime less likely to happen. As always, it's an effort-benefit tradeoff.

Someone1234 5y ago

This is one area where there are technological solutions to people problems. Namely, that currently an iOS device needs to be fully unlocked to be services but realistically there should be something between "service access" and "full unrestricted access to a customer's PII and app state." Keep in mind that in iOS root is rarely available, so even when servicing devices they're manipulating the OS via a restricted service interface that can only perform certain actions (e.g. wipe, re-flash, test different components, etc). I cannot access the original article, but I am hoping criminal charges were also utilized as this is unlawful in many states (and frankly should be national).

pradn 5y ago
There should also be audit logs recorded by the device and sent to the user's Apple account. So you can see which apps, screens, and data a service person used. This is a routine ask from companies to cloud providers, for example.
- davisr 5y ago
  Ah, yes, more surveillance is surely the answer.
  - CobaltFire 5y ago
    Of technicians accessing a device that is that personal and many people consider secure due to Apple's own marketing? Absolutely.
  - MikeDelta 5y ago
    Logging is not necessarily surveilance. It is about you seeing what they do with your phone.
    - deleted 5y ago
      [deleted]
  - deleted 5y ago
    [deleted]

KMnO4 5y ago

I couldn’t find the exact number of “millions” that Apple paid. Is it part of a class action lawsuit or did the entirety go to the one plaintiff? It amazes me that workplace conditions causing loss of life can be settled for much, much less (as low as $75k paid to the family).

IG_Semmelweiss 5y ago
I am not going to make a judgement on the morality, but this is not surprising. Awards for loss of life are actually codified in case law as being vastly smaller awards than the award for loss of limbs, senses, etc. It is somewhat logical since the primary injured (the dead) can't be made whole. Contrast this to someone injured but not dead - they will have to live with the injury for the rest of their life. Case in point - this girl. This is why disability policies are more expensive for higher income individuals. Presumably, the injured and his/her family depends on that income to live, and the income loss must be made whole.
- wallacoloo 5y ago
  > they will have to live with the injury for the rest of their life. Case in point - this girl. I’m conflicted in taking this side, but if it’s millions — with an s — given just to her, then she’s basically set for life. Never has to work again to maintain a decent middle-class life, because her FB friends saw her nudes. That seems wildly disproportionate — most everyone I know would gladly take that trade. If it’s a class action suit, or is constructed such that not all that money goes to this one victim, that’s a different thing. The part that disturbs me is whenever being a victim can become similar to winning the lottery.
  - muskox2 5y ago
    I'm sure in any case the lawyers took a hefty sum.
  - mlac 5y ago
    It’s easy to say “hey sorry network, you’re going to some explicit photos of me and I’m gonna make millions from it. Just ignore it and we’re good”. But that wasn’t the deal. This feels a bit like the McDonald’s coffee lawsuit. On the surface it’s easy for some to take that deal (nudes for millions) but consider this: 1) she might have been Facebook friends with family or family friends. 2) this could wreck someone in high school and cause issues with dating, friends, etc. taken the wrong way it could kill your social life and cause depression 3) people jump to assuming she’s conventionally attractive. She might be very shy about her body and was taking those for herself. People might have grabbed them and made fun of her.. 4) there was no guarantee of a payout and it took five years legal distraction during prime high school and college age for a resolution 5) if she is from a small town or a highly religious town, she will now be known as the girl that had her nudes leaked. If it was a religious town, it could have brought shame on the family and in some cases ended relationships 6) if this screwed up her high school trajectory, it could have messed up her grades and limited her college choices Lastly, I think part of this amount is to make it somewhat meaningful to Apple. If it happened once because they didn’t properly vet their 3rd party, a small fine would do nothing to prevent it from happening in the future.

perryizgr8 5y ago

I don't understand why they need to unlock the phone for hardware repairs. I took my Toshiba laptop for a motherboard replacement after a power surge, and never provided my password. They gave it back after the repair and the OS was literally untouched. I would think Apple with their trillions would have figured out proper hardware repairs by now?

dagw 5y ago
It's really easy to boot up a computer to a different OS installed on a different storage medium to test the hardware. Phones don't have the option.
- ysleepy 5y ago
  Phones actually do have that option. Android bootloader supports fastboot boot of an image file on the host PC, usually a recovery ROM. Apple is certainly capable to do that and I'm even sure that this exists on their devices too.
pcdoodle 5y ago
Unauthorized iPhone repair company here, We like to test the microphones and any other components that can be disturbed by the repair.
- kergonath 5y ago
  Way to go. I wish the guy who repaired my girlfriend’s iPhone a couple of years ago had done as well. What a cock up that was.
Someone1234 5y ago
Hardware requirements/differences mostly. With the laptop example they can pull the storage medium (2.5" HDD/SSD, or NVMe), service it, and then reinstall. Whereas iOS devices have storage soldered onto the mainboard and there's a cryptographic sync between the T2 chip and OS installation, so you cannot simply swap the storage onto a different phone (this is actually a legitimate security feature that just happens to hurt service-ability also). I believe there are things they can do (different levels of access, managed by iOS) but the laptop analogy doesn't help here since it is an Apples and Grapefruit kinda comparison.

boleary-gl 5y ago

I wonder how many times this has happened and they didn't find out about it. Posting it to her own Facebook made it pretty obvious. My father was an accountant for many years and he always said if you found evidence of fraud you shouldn't be congratulatory because what you found is maybe 10% of what is actually there if you found it by chance.

thatguy0900 5y ago
Happens a lot. I used to work at a att store, workers getting into trouble for saving pics off customer phones happened regularly. I remember it going around that a verizon(? I think,it was a while ago) employee ring got busted for having a shared Dropbox full of pics from multiple stores and all of our managers were on guard about it happening at att.
Cthulhu_ 5y ago
I feel like that's the case with most solved crimes, e.g. drug smuggling; they are proud of catching big shipments, but if the shipments are that big already it implies that it's only the tip of the iceberg, as in, don't put all your eggs in one basket.
smcl 5y ago
This came up in Ozark too (good series) someone busts an employee stealing something and isn’t sure what to do, gets the advice “Fire her. It’s not the first time she stole from you. It’s the first time you caught her.”
hellbannedguy 5y ago
I worked as a state security guard while I was going to school. It was a good gig because I could get all my homework done while working, and state law said my pay needed to be equal to full time employees. My boss took his job very serious. He got the state to send us to security seminars. This was the late 80's and what suprised me the most is whom steals, or commits financial fraud. At least back then most loss in retail was committed by management. The higher up the tree, the more they stole be it cash, or merchandise. The employees, and customers stole, but the big thefts were usually committed by long term trusted management types. The instructor said, employees/owners usually don't question management, and they have more opportunities alone, with no one watching. He also said owners were notorious for stealing their stuff, and writing it off, or claiming it as a loss through their insurance company. He said, this is a dirty secret, that most organizations don't want leaked. It's much easier to blame the homeless, or gangs on theft. I imagine that has changed with the proliferation of cameras everywhere, but when I gear about large scale theft in a corporation, I automatically look at those in command of the employeees. My local Goodwill had gone through three store managers in a row for embezzlement. This was years ago though. Goodwill never prosecutes employees because they don't want to tarnish their image.

zamalek 5y ago

Didn't Apple testify that allowing third-party repairs would risk user security/privacy? If Apple can't be trusted either, and has to be sued before making things right, isn't the testimony superfluous? This another example why nudes and so forth should never make it onto a digital device. If that's your kink, then Polaroid cameras and camcorders exist.

fastball 5y ago
Or just keep sensitive things in an encrypted container. Pretty easy to set up an encrypted sparsebundle on a mac for all your naughty photo needs!
wongarsu 5y ago
> If that's your kink, then Polaroid cameras and camcorders exist. That sounds a bit like the Onion sketch "Google allows you to opt-out of tracking by moving to remote mountain village" [1]. This case proves that the criminal justice system works to protect your personal images, we just need a better way to be notified when it happens (the kind of action you would expect Apple to take if they cared, instead of "we continued to strengthen our vendor protocols") 1: https://www.youtube.com/watch?v=lMChO0qNbkY https://www.youtube.com/watch?v=lMChO0qNbkY
- khuey 5y ago
  The story doesn't mention anything about any criminal charges. The only reason they got caught is because they uploaded the pictures/videos to her Facebook. If they had sent them to a porn site instead they would have gotten away with it. The grandparent is largely correct, if sexually explicit photos/videos of you make it onto a digital device controlling their distribution is difficult at best.
emsy 5y ago
This should be the top voted commen. This is similar to their claims about App Store security, on which they continuously fail to deliver. They want absolute control but don't give you absolute security and they are only ever liable if you take them to court personally (and who wants to take the worlds biggest company to court really?).

qrbLPHiKpiux 5y ago

I took my MacbookPro to an Apple store to have the keyboard replaced. I dropped it off. They called me later that day saying it was almost ready to be picked up, but they needed the bios password. I asked what for. They said they need to check the function. I said that defeats the purpose of the bios password. (o_O) I did not give it and they said if there were any problems to bring it back.

dqpb 5y ago

Breaking News: trusted authority can’t be trusted.

throwaway10474 5y ago

They get mad when you show up at the apple store for service having just reset the phone. “We take privacy seriously”, “you can trust us us”, blah blah blah. No. Always fully wipe before handing your phone or laptop over to anyone you don’t know and trust.

kergonath 5y ago
> They get mad when you show up at the apple store for service having just reset the phone. They don’t. I’ve done it several times with my old MBP and a couple of iPhones. I never leave a device with a technician without wiping it first. If someone gets upset about that, the proper thing to do is escalate with the manager, because that would be highly irregular.

fortran77 5y ago

We're running out of options here. Both Apple and Google are fatally flawed companies. I think I may go back to using a feature phone.

teekert 5y ago

I once brought my MBP 15" Early 2011 into an Apple store (or maybe an authorized reseller? For that GPU snafu), they wanted the admin password with it... ugh I felt dirty giving them that. Just boot from stick to test the hardware, leave my hdd/ssd alone!

asdff 5y ago
Eventually they stopped booting into your account and now they plug in whatever computer they get into the store's intranet and boot off their images. I'm surprised it took them years to do that, though.

marcodiego 5y ago

I remove any media from my computers when I send to a repair shop. If any media fails, it should be destroyed. If you ever sells storage media, dd if=/dev/zero it; also consider that it may not be enough with some wear leveling SSD's. A few years ago, someone bought an used harddisk and got some private information of Brazil's then first lady Marcela Temer[0] and tried to blackmail her. He was later caught and imprisoned, but not everybody has the same luck. [0] http://g1.globo.com/tecnologia/noticia/2016/10/hd-comprado-ha-8-anos-e-pivo-da-clonagem-do-celular-de-marcela-temer.html http://g1.globo.com/tecnologia/noticia/2016/10/hd-comprado-h...

alekratz 5y ago
> dd if=/dev/zero it or `shred` it. Probably takes longer but more secure.
- wang_li 5y ago
  /dev/zero is perfectly fine for modern high density drives. If the drive in question is MFM or RLL from the '80s or '90s, then absolutely go bananas with 53 different bit patterns. But otherwise zeros is effective for nay hard drive made in the last decade. SSD has issues with wear leveling, so good luck wiping those. Though you're only going to have to worry about someone who is willing to disassemble the SSD device and read the chips individually.
megous 5y ago
It helps if you never store unencrypted data on the drive.

yawaworht1978 5y ago

I wonder how often this happens in unlicenced repair junkyard shops. Sometimes they ask for the main login pwd for no good reason.

topspin 5y ago
Privacy violations are one of the floats in the Parade Of Horribles that Apple el al. offer when attempting to defend their repair monopoly. Guess that argument is out the window.
- rantwasp 5y ago
  whoa whoa. no system is perfect. just because this happened does not make it the SOP.
  - saurik 5y ago
    And yet I trust "Cupertino iPhone Repair" (my go to third-party repair people, in whom I have quite a lot of trust) or "Shakeel the iPhone Repair Guy" (that is a legit place I have multiple friends who highly recommend, though I haven't used him personally; I have, however, heard detailed stories of his process) more than this process from Apple on this matter of data privacy (and always have: this story has changed nothing for me except help me prove to others how careful you have to be) as my chosen third-party repair people will repair my phones while I wait--often in front of me (making it quite difficult to screw with me very much)--and notably don't ask me for my passcode. If Apple's system isn't, in fact, perfect--or at least nearly so--then they can't continue to morally justify their monopoly on grounds of "but everyone else is dangerous!! only we can be trusted!!" (not that that should allow their behavior anyway, but it isn't even a legitimate defense).
    - rantwasp 5y ago
      i have literally never been asked for a password by apple when I had issues. I unlocked my phone myself when they needed to look at something and they looked at it only while I was present. If they needed to take the phone “in the back” I made sure it was locked (this was for a screen replacement) or I simply wiped it when it had an issue that needed replacement.

kossTKR 5y ago

I've experienced that repair shops ask "and your password and username is?", many times when handing over my laptop - and i'm always like "what, no i'm not giving you my password" resulting in them looking surprised. Who the on earth gives their passwords, also all laptops should be encrypted by default. I find it absurd to give away the keys to your bank, search history, personal notes, images, whatever - it's beyond private and personal besides being economically dangerous and very bad job security wise for most jobs. Not blaming regular people though, but it's weird that people are so lax about giving the keys to absolutely everything.

Sebb767 5y ago
I feel this is a bit like popping your hood at the car shop, but taking your key with you. I can absolutely see why repair shops would want to verify that a) it's not a software problem and b) everything still works fine afterwards, both of which is hard w/o the password. Sure, you can send in a wiped device or a device without hard drive - and if you can do so yourself, this is probably fine. But for the "average" user it's quite likely a better experience, assuming you can trust the repair shop - but then again, they have full access to your hardware plus the knowledge and time to permanently bug your device. If you really don't trust them, you probably should not give them your device at all. I can see the issue here and I'd probably err on the side of privacy given the choice, but the other side has a point.
- baby 5y ago
  They can do this from a guest account. Full disk encryption will protect your data.
  - Sebb767 5y ago
    No, it won't. They could simply put in a different BIOS chip, which records you password the next time you enter it. Or a malicious RAM chip that injects a virus at runtime and extract your data that way. Or a bugged keyboard that transmits your key presses, combined with a full copy of your disk ... Sure, it's a bit more sophisticated than Ctrl+C/Ctrl+V. But if you're running a computer repair shop, it is quite likely that you have a good amount of technical knowledge. If someone has hardware access, you can usually see your device as compromised - especially if they have a lot of time and are expected to open up the device.

princevegeta89 5y ago

Why would she even hand over her phone to them while she knew there were explicit photos and videos of her in it?

Tepix 5y ago
Some defects will prevent you from erasing the phone before giving it to a repair center.
andreime 5y ago
your question reads like you're saying it's the victim's fault
- josefresco 5y ago
  It's not, but it's still careless or slightly reckless behavior. Like leaving a pile of valuables on the front seat of your unattended (but locked) car.
  - Natfan 5y ago
    That analogy doesn't really work here, because then anyone who's walking past could steal the valuables in your car. Consider that you had to send your car in for repairs to the company that produced your car, and you placed some valuables in your (locked) glove compartment. They then steal all of your valuables. The car company (or their trained engineers) should never have to entered the glove compartment at all. The fact of the matter is that you left your valuables in your car with a trusted third party, and that trust was abused and your valuables were stolen. The issue isn't that someone stole your stuff, it's that you trusted the company that built your car to not go snooping around and stealing your stuff. Trusting a third party is not "careless or "reckless" behaviour, the onus is on the company to behave responsibly with your personal items/data. EDIT: I took a look at the original article from the Telegraph[0], and it seems like the perpetrators were an Apple contractor called "Pegatron". While this isn't as bad as a BMW employee stealing stuff from a locked compartment in your BMW car, it still isn't great. If this contractor was officially allowed to perform repairs (which it seems like they were, as Apple paid the lawsuit), then they should be held to the same standards as Apple employees when it comes to data privacy. [0]: https://archive.ph/WFaO9 https://archive.ph/WFaO9

beckman466 5y ago

Talented business consultant Nathan Fielder covered this topic not long ago. I believe he was the first one to spot this gap in the market for an asexual computer repair service. He actually shares his findings with us here: https://www.youtube.com/watch?v=jf9I04Oa-hU https://www.youtube.com/watch?v=jf9I04Oa-hU "Nothing is more powerful than an idea whose time has come."

yosito 5y ago
I know there is historical precedent for royals trusting eunuchs with things they can't trust to horny men, but these days I'd be very skeptical of any repair service saying "Don't worry, you can trust us because we're asexual". This is like a priest saying, don't worry you can trust me not to be tempted by anything "sinful" because I'm a priest. Information security is not just about sex. I'd rather trust a computer repair service that passes third party security audits and is verfiably secure. The sexuality of employees is none of my business.
- WFHRenaissance 5y ago
  The genius of business consultant Nathan Fielder is that his empathy for the consumer is near-unlimited. Sure, you may have some opposition to the methods at use in the above consultation, but it put customers at ease. He saw the market before it existed. He put the customers first, and it worked. We can all learn something here I think.
  - Sebb767 5y ago
    That's not the point the previous comment made, I think. It's not that you could not trust asexual people to be calmer in this regard, but someone willing to sniff and publish your private data is probably not going to be afraid to lie to you when you ask whether they are asexual.
    - Sholmesy 5y ago
      While the thought process here is sound, and I agree with you, watching the video will probably reveal that national treasure Nathan Fielder is also a part-time comedian alongside being an exceptional business consultant.

diehunde 5y ago

Why would they do that? I mean what was the point of posting the pictures to her own account?

wonderwonder 5y ago
Cruelty is the point

arthur_sav 5y ago

I went to an Apple certified repair shop to fix my macbook. They asked me for my login password... Sure let me just give access to all my banking apps, photos, browser sessions etc... I ended up creating a guest account for them but i was surprised they didn't have a policy not to access private user data or ask for passwords.

fernandotakai 5y ago
funny -- when i had to service my old macbook, the repair shop asked for a guest account since they didn't want access to my stuff.

cvwright 5y ago

Title doesn't tell the half of it. "Personal images" are photos of your kids playing in the backyard, or dinner with your extended family. What they stole here was much more intimate than that.

hownottowrite 5y ago
There's only so much room in the title.
- saagarjha 5y ago
  Perhaps "intimate images" would work?

mymythisisthis 5y ago

Shouldn't the technician be charged with sexual abuse, and face jail time?

wonderwonder 5y ago
100% Surprised they were not arrested or no charges were filed. (or at least the article did not mention it)

ArkanExplorer 5y ago

Given the millions paid out for essentially the malpractice of these technicians, is it possible in another scenario that a 'victim' and technicians collude to repeat the same outcome, and split the court winnings? The technicians remain nameless, and suffer no reputational damage, just losing their jobs. Put another way - how is Apple actually responsible for the activities of these individual technicians?

wang_li 5y ago
Congress does this as well. They pay out millions in sexual harassment claims to staff and they never name the people involved. What should happen here is the technician should be named, there should be big billboards put up in whatever town they live in, and they should have to get "I distributed child porn" tattooed on their face. As well as not be allowed to come within 50 yards of a computer or cell phone or transistor. There are harms you can't undo and the punishment should be as permanent as the harm.

phkahler 5y ago

A Facebook friend posted about getting a new phone. It was one of the last posts before someone tried to fish me through FB messenger posing as her. I reached out to her father, brother, and one friend that she posted pictures with - all people that know her IRL. All 3 appear to be compromised. I keep thinking this may have started with her old phone getting in the wrong hands.

Natfan 5y ago

Just to clarify, the article states that the victim is 21, and that the offence occurred in 2016. Does this mean that she was a minor at the time, and if so was the sharing of these images as similar crime to distributing child pornography?

TigeriusKirk 5y ago
Facebook presumably knew her age and has filters for nudity. I'm surprised they didn't catch it.
LorenPechtel 5y ago
But is that 21 now, or 21 in 2016 when the offense was committed?

dathinab 5y ago

It's kinda funny that Apple denounced 3rd party repairs with "because they could misuse your data" while (proper) 3rd parity repair shops normally don't ask for you password and in turn can't access the phones data after it had been shut down once. I'm more irritated that a Apple repair shop asked for login information then that a repair person with login information abused them (which sadly isn't surprising).

ezoe 5y ago

Seriously unless it's OS filesstem corrupted, Apple has no need to decrypt the user storage. If they can't do that, it just mean their design of the computer is horrible. I get that people need fancy thin phone, but storage and battery shall be removable. The only workaround as of now is not to own a phone which I exercise. I can't trust any of them.

s1artibartfast 5y ago

The article doesn't specify if the sharing of photos was intentional or not. There should be safeguards either way, but it seems that most articles and posters are assuming that it was. I can imagine a number of ways to accidentally or automatically sync photo albums to Facebook, and this is one of the main reasons I don't have it on my phone. Similarly, if the privacy breach was intentional, I would have guessed the techs would have downloaded the content and done something that was less obviously traceable to them.

xkjkls 5y ago
Seems pretty obvious it was intentional. The amount of planets to align for a repair tech to accidentally post 10 nude photos to Facebook is greater than the number in the Solar System.
- hollerith 5y ago
  What seems most likely to me is that the tech or techs intentionally viewed the pics, but while doing so unintentionally uploaded to Facebook.
ljm 5y ago
How do you unintentionally open someone's FB app and then unintentionally go to submit a post, and then unintentionally open the photo gallery and unintentionally attach a select few nude pics before unintentionally confirming the selection and unintentionally submitting the post? Perhaps more than once? I don't recall FB having a mechanism to automatically sync your camera roll to your FB feed. Or do you mean to suppose they thought they were on there own FB account and expected to send the pics to themselves?
- s1artibartfast 5y ago
  That's one of the reasons I brought it up. I thought there were setting to upload the camera roll or back it up to FB without ever going into FB itself. I'm not a FB user any more, so I can't confirm something like this: https://www.dpreview.com/news/5620765515/facebook-photo-sync-auto-upload https://www.dpreview.com/news/5620765515/facebook-photo-sync...

exabrial 5y ago

Besides being fired, is the individual facing charges?

EvilEy3 5y ago

So where are the pictures?

nomoreplease 5y ago

> In a statement to The Telegraph, Apple said “when we learned of this egregious violation of our policies at one of our vendors in 2016, we took immediate action and have since continued to strengthen our vendor protocols.” Yet it took us 5 years to figure out how to make this right with the victim.

tsjq 5y ago

How many of those millions goes to the lawyer?

vinni2 5y ago

> One of the issues here is that Apple instructs customers to send in their iPhone with the passcode disabled, which allows anyone in the chain to access any data stored on the device. This right here is the problem. Apple must not ask people to turn off passcode instead reset iPhone.

acchow 5y ago
Surely this isn't still Apple's policy in 2021? Doesn't seem to fit their privacy-first model.
- singlow 5y ago
  My irony detector is not giving me a clear reading...

tgsovlerkhgsel 5y ago

I wonder what (if anything) the repair techs thought when doing it. If a disgruntled employee wanted to maximize damage to the company (without regard to personal consequences), this surely looks like one of the ways to do it. I think it's still more likely that they just did it because they found it funny, but this is a kind of insider risk for companies that is really hard to defend against.

WalterBright 5y ago

I'm not sure why the actual people who did this aren't held accountable instead.

contingencies 5y ago

Possibly one of the shortest and most successful modeling careers ever? Well done to the student. Now she is undoubtedly hot, young and rich.

bacan 5y ago

Another reason to support right to repair

ashtonkem 5y ago

Shouldn’t the workers who stole those photos be prosecuted criminally?

nsajko 5y ago

Maybe this thread should be merged with https://news.ycombinator.com/item?id=27420044 https://news.ycombinator.com/item?id=27420044

nirav72 5y ago

looks like IOS needs some kind of valet key feature...

ChrisArchitect 5y ago

Fair she got a settlement but immediate reaction to this report was it sounds like automatic facebook uploading? Like it's pretty crazy the techs went to trouble of uploading, but if her account was logged in/app logged in (as most are) then even a small adjustment to settings as far as what folders to upload etc might have triggered? Not saying it wasn't malicious, likely was, but man, seems like could also be an accident of resetting settings etc