11 ms·

With this announcement, Apple are saying "we will protect you from state actors", which is a role usually performed by states. Apple is saying "we operate at th

With this announcement, Apple are saying "we will protect you from state actors", which is a role usually performed by states. Apple is saying "we operate at the same level as nation states; we are a nation-state level entity operating in the "digital world": It's a flag-raise. It's the first such flag-raise I've seen. Security researchers talk about protections from state actors all the time, and there are tools which support that... but this is the first public announcement, and tool, from a corporation with more spare, unrestricted capital than many countries. It comes at a time when multiple nation states are competing for energy and food security; and Apple are throwing up a flag for a security-security fight (or maybe data-security). This is not just handy tech, it's full-on cultural zeitgeist stuff. Amazing.

ivraatiems 4y ago
The NSO Group, whom Apple specifically cites as an opponent that inspired this work, is a private corporation. They sell to governments, but so does Apple. The relationship between state and private industry has never been binary and has always had features like this. I don't think this is a "Jennifer Government" type scenario.
- thehappypm 4y ago
  NSO is pseudo-private, kind of like Raytheon.
  - dfc 4y ago
    Raytheon (NYSE:RTX) is a publicly traded corporation.
    - thehappypm 4y ago
      My point is not public vs private structure, it’s that Raytheon is essentially a government entity at this point
bsedlm 4y ago
agreed, the rise of the corporation as the most powerful institution (above the nation-state) in this new budding global civilization is a long time coming. on the other hand, this is how democracy dies. what structures (systems) exist to prevent apple (and other comparable corporations) from being an oppresive force against human persons? moreover, what incentives do they have?
- kube-system 4y ago
  Corporations definitely have a lot of power today, but nothing more than they've had in the past. https://en.wikipedia.org/wiki/Company_rule_in_India https://en.wikipedia.org/wiki/Company_rule_in_India
- scottyah 4y ago
  To be fair, banks have been more powerful than a lot of nation-states for awhile, and religious entities before that.
  - atlasunshrugged 4y ago
    The religious entities I get the argument but what banks have been more powerful than nation states?
    - bsedlm 4y ago
      the ones that only service other banks hence only people working in higher level banking are likely to have heard about. e.g. the bank for international settlements I only found out about this bank because the former president of the mexican central bank -- Mr. Carstens, left the central banking gig to go to that bank.
      - atlasunshrugged 4y ago
        From reading their Wikipedia quickly sounds like BIS has a similar function to say the IMF when it comes to financial system stability. I do agree these sorts of organizations exert huge amounts of influence, especially for smaller countries that are dependent on loans and outside financing, but I'm not sure I agree they are more powerful than a nation itself. A nation can (theoretically) decide to opt out from these systems and operate independently, or can play different parties funded by nations (because in the end they all are working for someone's agenda) off of one another as many countries did during the cold war between the U.S. and Soviet Union. But if a nation reneges on its debt, the BIS, IMF, etc. isn't going to invade your country--one of it's creditor nations might, but not them.
axolotlgod 4y ago
Definitely very interesting. I know Google has their “Advanced Protection Program”[0] with a Titan security key which is similar. It is interesting considering that Google’s protections target the user as the weak link, as your data lives on their hardware; while Apple is obviously targeting both the user and the hardware they have. I’m curiuos what security researchers will think of this, if it’s more theater or if it is actually a innovative attempt at giving advanced privacy to people who need it. Despite their past stumbles (e.g., CSAM), it seems like Apple is genuinely in the privacy fight, even if it is just for their bottom line. [0]: https://landing.google.com/advancedprotection/faq/ https://landing.google.com/advancedprotection/faq/
- alwillis 4y ago
  "About Apple threat notifications and protecting against state-sponsored attacks": https://support.apple.com/en-us/HT212960 https://support.apple.com/en-us/HT212960
legalcorrection 4y ago
I think you're letting the reality distortion field get to your head. They're creating a safe mode for iPhones because a lot of features complex/intricate enough that they are perennial sources of vulnerabilities (and/or UX flaws that lead users to make unsafe decisions). That is, they're turning features off for security. Something every IT department has been doing for decades. Windows supports this. Mac OS supports this. In fact, iOS was kind of notable in being so unconfigurable. The settings available in their MDM implementation were pitiful and didn't let admins disable many of these features.
- saagarjha 4y ago
  One difference is that Apple is actually quite good at understanding which features get exploited in zero-click attacks and IT departments are not.
newaccount2021 4y ago
Swizec 4y ago
> Apple is saying "we operate at the same level as nation states; we are a nation-state level entity operating in the "digital world" Apple's profits are bigger than my country's (Slovenia) whole GDP. You bet your butt they're a state level actor in the digital world. They have more resources than many countries. If Apple was a country, their $365bn in revenue would make them the 43rd richest country in the world right after Hong Kong. https://en.wikipedia.org/wiki/List_of_countries_by_GDP_(nominal) https://en.wikipedia.org/wiki/List_of_countries_by_GDP_(nomi...
- amelius 4y ago
  And if you computed the per-capita GDP?
  - Swizec 4y ago
    Hard to compute because contractors don't count towards Apple's official headcount. Comes out to $2.5mil/employee using wikipedia numbers. GDP per capita for Slovenia is $25,179 in comparison. 100x less. For Hong kong, which makes a bit more GDP than Apple does revenue, the per capita number is $46,323. 50x less than Apple.
    - whateveracct 4y ago
      Also silly to compare because a proper nation-state does more than develop products and services for profit. Social contract and all that.
      - Swizec 4y ago
        My understanding is that the "social contract" inside many of these large companies is quite cushy. Especially in USA where being employed comes with services traditionally provided by the state like health care, child care, free or subsidized food, retirement benefits, etc.
        whateveracct 4y ago
whatgoodisaroad 4y ago
At the same time, if that state actor happens to be China, Apple will just give the government access to your iCloud data. Not all state actors are equally within Apple's striking range.
- milesskorpen 4y ago
  If you opt-in to iCloud, you're opting in to a lot of state-level security risk in any country (and this is true of any commercial cloud).
  - KennyBlanken 4y ago
    Nothing stops Apple from offering e2ee backups, and in fact they do this for certain data backed up to iCloud (health data for example.) But your iMessage data...well there, your ass is hanging out in the breeze. In fact, I'm not sure it's possible to log into an iPhone with your Apple ID and not have an iCloud backup immediately fire off, which means your private encryption keys hit iCloud and stay there until it is purged according to their data retention policies. And we have no idea what those policies actually are; those keys made end up stored forever.
    - GeekyBear 4y ago
      > Nothing stops Apple from offering e2ee backups The US Government pressured them to drop a plan for fully encrypted cloud backups. >Apple dropped plan for encrypting backups after the FBI complained https://www.reuters.com/article/us-apple-fbi-icloud-exclusive/exclusive-apple-dropped-plan-for-encrypting-backups-after-fbi-complained-sources-idUSKBN1ZK1CT https://www.reuters.com/article/us-apple-fbi-icloud-exclusiv... If you want a fully encrypted backup of your device, you have to make it to your local Mac or Windows computer.
    - thewebcount 4y ago
      > I'm not sure it's possible to log into an iPhone with your Apple ID and not have an iCloud backup immediately fire off Yes, it absolutely is possible. I have never turned on iCloud backup so I have no cloud backups of any of my phones or other devices.
KennyBlanken 4y ago
Apparently that protection does not include protection from the US government. iMessage offers excellent privacy of message content, but no 'pen register' protection. Phone device security is very strong, but it's made largely moot if you turn on iCloud backups (which is the default behavior if you provide an Apple ID. I'm not sure there's even a way to stop the initial backup from happening?) Apple reportedly doesn't offer e2ee on iCloud, or even encrypted device backups, out of compromise with the federal government...specifically the FBI, CIA, and NSA. Why might people care about this? Criminalizing abortion and miscarriages...and what looks like at the very least a re-recognizing, and possibly criminalization, of LGBTQ relationships.
- eastbound 4y ago
  True, Apple could stop nagging about backing up into iCloud. Apple should offer other sorts of backups, and offline iCloud systems.
  - threeseed 4y ago
    They do offer other sorts of backups. You can backup to a Mac or PC. And it's offline and encrypted.
- kube-system 4y ago
  When Apple says "state actor threats" they're not talking about future-state theoretical breaches of domestic privacy by your own government. Apple is always going to follow the law. They're talking about the types of situations where data from people's phones is used to commit international criminal activity, espionage, assassinations, etc.
- germandiago 4y ago
  I know it is a very polemic topic but I genuinely think abortion is a crime, not a right. Not anything against LGBTQ or the like, though.
spamfilter247 4y ago
Microsoft has a “Democracy Forward” team (previously called “Defending Democracy”) that aims to protect government officials and systems from adversarial state actors. It’s been ongoing for a few years now. https://www.microsoft.com/en-us/corporate-responsibility/democracy-forward https://www.microsoft.com/en-us/corporate-responsibility/dem...
- seanw444 4y ago
  Given their track record, I'd trust Microsoft approximately 0% to secure my critical/sensitive systems. The funny thing is that the U.S. government does, in fact, trust them.
kmeisthax 4y ago
There's a bit of a journey from "protecting you against government hackers and spooks" to full-on sovereign states; and there's a lot of things that a country's government funds that Apple couldn't even begin to take on[0]. Physical security and military operations are a hell of a different field from that of locking down computers. Furthermore this isn't the first of its kind; Google has been alerting high-risk Gmail users about state-sponsored hacking for about a decade now. Microsoft probably does something similar. Apple is comparatively late to the party on this. On the offensive side you have the zero-day vendors that broker exploits between hackers and the government. A better explanation is that Apple isn't supplanting the US government. It's supplanting Halliburton. As more and more people and things go online, hacking and doxxing them is becoming more militarily valuable than just arresting someone or firing a missile. After all, physical attacks risk counterattacks and escalation, but Internet attacks are relatively cheap, not really treated as an attack by many sovereign states, and, most importantly, difficult to attribute. [0] Call me when Apple black-bags Louis Rossman for illegally repairing MacBooks, or threatens literal nuclear war - like, with uranium bombs and radioactive fallout - on the EU for breaking the App Store business model.
- lwswl 4y ago
  I've always thought that the companies coded the "zero day exploits" in, and then sold them for profit.
  - ivraatiems 4y ago
    I'm not saying it never happens, and I don't want to assume anything about your background, but I think most people who work in software would agree there's no need. Plenty of problems get in on their own.
    - dylan604 4y ago
      RSA weaker key set to default perhaps?
    - skrtskrt 4y ago
      yep if that were your goal it would be way more cost effective to get a zero day from just not trying that hard with security practices. Not having any security knowledge on the team. Not patching/upgrading dependencies with security bugs.
starwind 4y ago
> Apple are saying "we will protect you from state actors", which is a role usually performed by states Not to sound flippant, but defense attorneys do this, too. I don't think it's as big a zeitgeist as you think
- the_other 4y ago
  Good to know. I think Apple's announcement (and as I've learned from this thread MS's and Google's similar programmes) represent a significant step-change. A single defense attorney performs this action on a case-by-case basis, and they earn "single human" levels of income from it. They (to some degree) use that money to make themselves comfortable and perhaps share it with charities and make investments. All the defense attorney's in the world combined still, probably, have access to a fraction of Apple's budget, and a fraction of Apple's audience. Defence attorneys don't always win all their cases. Apple have the kind of money that makes 1000s of attorneys envious. Apple use that money to make infrastructure and client devices and then sell/share that technology with billions of people. Most of Apple customers buy their phones on loan agreements over some contract time-frame. It's "cheap", and the protections are automated. I'm tired and getting rambly about this now, but I intuitively feel like the combination of state-level power (albeit exercised with a very narrow focus), and the way so many people live their (digital) lives interacting with a "noosphere" that crosses international borders are facets of a complex phenomenon we have not witnessed before, and which will merge with other related facets and then emerge as something really different. I accept I'm getting very fuzzy in my thinking here. I'm leaning into my inner sci-fi author (who's not come out for 30years and wasn't too talented when it did).
  - alwillis 4y ago
    Excellent points. I don’t think it has sunk in for most HN readers that every iPhone since iPhone 8, released in 2017, can upgrade to iOS 16 and get Lockdown Mode. Apple is providing some protection against state-level actors at scale--hundreds of million devices. That is a step change!
celdon25 4y ago
> Apple is saying "we operate at the same level as nation states; we are a nation-state level entity operating in the "digital world": It's a flag-raise Maybe. But these security “features” feel like things that should have been there from the beginning. Windows 11 has already had a much wider and deeper array of security options. Sure, it’s not mobile, but many of those security options would be unlikely to be needed against unsophisticated attacks. Flag-raise or marketing gimmick? You be the judge I guess.
ziddoap 4y ago
>Apple is saying "we operate at the same level as nation states; we are a nation-state level entity operating in the "digital world" Making mountains out of molehills. I'm pretty sure they are saying that they will "offer specialized additional protection to users who may be at risk of highly targeted cyberattacks from private companies developing state-sponsored mercenary spyware". There is a looooong list of things which nation states can do which Apple cannot, some examples of that are in other comments in this thread. >but this is the first public announcement, and tool, from a corporation with more spare, unrestricted capital than many countries. Google & Microsoft have both had fairly long-standing tools and procedures (which were publicly announced) to both alert users and aid users against nation state attacks.
- alwillis 4y ago
  Apple also started alerting people being targeted by state actors last year [1]. [1]: “About Apple threat notifications and protecting against state-sponsored attacks” https://support.apple.com/en-us/HT212960 https://support.apple.com/en-us/HT212960
- sodality2 4y ago
  Google's Advanced Protection program is the same: https://landing.google.com/advancedprotection/ https://landing.google.com/advancedprotection/
cma 4y ago
> It's the first such flag-raise I've seen. After the Snowden leaks that showed even in-country citizen-to-citizen communication was being scooped up by the NSA without a warrant through fiber taps (if I remember that right) when Google replicated the data to out-of-country data centers, Google announced encryption of those links: Google encrypts data amid backlash against NSA spying https://www.washingtonpost.com/business/technology/google-encrypts-data-amid-backlash-against-nsa-spying/2013/09/06/9acc3c20-1722-11e3-a2ec-b47e45e6f8ef_story.html https://www.washingtonpost.com/business/technology/google-en...
modeless 4y ago
> It's the first such flag-raise I've seen You haven't been paying attention. Many tech companies have been protecting accounts from state attackers for many years, and explicitly calling out state sponsored attacks. Google introduced state-sponsored attack warnings in 2012 [1] and the Advanced Protection program explicitly protects from state sponsored attacks [2]. [1] https://security.googleblog.com/2012/06/security-warnings-for-suspected-state.html https://security.googleblog.com/2012/06/security-warnings-fo... [2] https://blog.google/threat-analysis-group/protecting-users-government-backed-hacking-and-disinformation/ https://blog.google/threat-analysis-group/protecting-users-g...
- alwillis 4y ago
  Many tech companies have been protecting accounts from state attackers for many years… How many people have Microsoft and Google actually helped? Incase you didn’t notice, Apple is in the process of giving a few hundred million iPhone owners--every iPhone since the 2017 iPhone 8--protection from state-level actors, for free, in the next operating system update due this fall. It totally dwarfs anything that any other company has done in this area. So there’s that.
  - modeless 4y ago
    Google sent more than 50,000 state sponsored attack warnings in 2021. And those warnings started in 2012. So a lot of people have been helped. Meanwhile Apple didn't start doing similar warnings until less than a year ago. > Apple is in the process of giving a few hundred million iPhone owners Um, no? Lockdown mode is explicitly for "very few users". There's no way a hundred million iPhone users would benefit. Google's Advanced Protection offers protection from state-level actors to anyone with a Google account, so if you want to count by the number of people offered optional protection, Google wins by a landslide. > for free Haha, no, you have to buy an iPhone from Apple first. Google offers protection to anyone actually for free. All you need is a free Google account and a security key which doesn't have to be purchased from Google.
    - alwillis 4y ago
labrador 4y ago
Apple is following the lead of Microsoft in this regard. Microsoft has been acting as an international cyber defense agency for a few years. On the effectiveness of Ukraine's cyber defense: "Microsoft in particular has been hard at work" 21:45 Assessing Russia’s War in Ukraine https://youtu.be/CzbsPOaCrLw?t=1305 https://youtu.be/CzbsPOaCrLw?t=1305
marcodiego 4y ago
Since the software is still proprietary, considering these statement as guarantees is just an exercise of faith.
stefan_ 4y ago
I think you need to put away the pipe, this is Apple saying "we can't make JIT work safely so here's an option to turn it off".
- alwillis 4y ago
  This is more like “there are always going to be zero-day exploits out there and until we can fix them, this is the next best thing."
- threeseed 4y ago
  > Apple saying "we can't make JIT work safely so here's an option to turn it off" To be fair has anyone made it work safely ?
LegitShady 4y ago
Counterpoint - the EU has been passing laws that force apple to be more fair in their markets, and this "we're protecting you from bad guys" stuff is apple trying to figure out deniable methods to protest or sue against the EU passing laws to restrict apple's ability to lock other developers out. Throw together a basic set of options that should have been available long ago, now apple is protecting you, don't strip apple of the ability to protect you, etc.
atmosx 4y ago
Nothing new. When states requested access to covid DB apple and Google refused access based on what happened in the Netherlands in WW2. I must that on one hand it’s anti-democratic, on the other hand western democracies have a rather poor track record on safeguarding this kind of info.
unethical_ban 4y ago
No, they aren't, any more than an OS claiming "military grade encrypted boot drive" means they have a military.
germandiago 4y ago
This is good news IMHO because it encourages that companies compete for the best offer in that space as they go. In some way it reminds me (with all the differences!) of how things like cryptocurrencies could remove the state from a monopoly. Good news for me this announcement!
dotnet00 4y ago
This feels like an argument the government would make against strong encryption like in the case a few years ago where the government tried to force Apple to unlock an iPhone and Apple refused claiming it wasn't possible. Apple are basically saying that they're going to do their best in terms of security measures to thwart even state actors, which is only as much of a nation-state level thing as "military grade encryption" is a thing only applicable to militaries.
moogly 4y ago
> It's the first such flag-raise I've seen Zuckerberg, 5 years ago: https://www.youtube.com/watch?v=mFPAe8Tc2NE https://www.youtube.com/watch?v=mFPAe8Tc2NE
- foobiekr 4y ago
  Perhaps "first credible" is the correct description.
  - moogly 4y ago
    I'm not so sure about that; I'm not that impressed by that list of features.
jiveturkey 4y ago
> It's the first such flag-raise I've seen. “Flag-raise” seems a bit hyperbolic but at any rate I think the BSA asserted such reach and power, long ago. Both have to act within the oversight of actual nation states. Beyond that, a secure phone is necessary but not sufficient to defend oneself against a nation state.
mnd999 4y ago
Do you also believe the earth is flat?
wyuenho 4y ago
A nation state has more than one way of extracting information from enemies of said state. There's the civilized way we now call hacking, and then there's the traditional way, which may or may not involve technology.
time_to_smile 4y ago
I don't know if you've been paying attention to Apple's strategy over the last year, but it's basically been "granting user privacy also happens to grant us an advertising/data monopoly" I don't think the aim here is to block at state actors but to basically continue to close all security holes that can be exploited by any other company and continually proving to users that Apple cares about privacy. The things is I really like Apple even more now since they have realize that my privacy interests can be tightly aligned with their own economic interests. I never trust companies to be good or look out for my interest even when I pay them to, but when my privacy ultimately means they gain a very strong competitive edge the I'm much more trusting. Apple has realized they can become to privacy what Google has been to ubiquitous search, and doing so can reap even larger and more secure rewards. They started with a walled garden and now extending it to fortress surrounding the garden.
- happyopossum 4y ago
  > advertising/data monopoly not to be glib, but 'citation please?' Other than running ads inside the App Store, do you have any knowledge or evidence of Apple collecting personal information for advertising or any other use?
kccqzy 4y ago
Google has been dealing with nation state actors targeting its users (Gmail specifically) for a decade now. They have Advanced Protection program. We actually regularly used to hear about how human rights activists were targeted in spear phishing campaigns and then arrested. https://landing.google.com/advancedprotection/ https://landing.google.com/advancedprotection/
the_gipsy 4y ago
It's marketing and you ate the hook, line, and sinker.
lolbutwutf 4y ago
Apple blocking a few features means it's now operating as a nation state. Tell me it's a Hacker News comment without telling me it's a Hacker News comment.
bmitc 4y ago
> from a corporation with more spare, unrestricted capital than many countries ... than most countries. There are only 7 countries with a higher GDP than Apple's market cap. I have been concerned for some time about these mega corporations being as powerful if not more powerful than governments. They wield tremendous economic and political power. Corporations have very little allegiance to countries and have little to check them. It is a major concern of mine. Democracy in the U.S. is already being sold to the highest bidders. These corporations are feudal lords but much, much more powerful because there is not a single person who can be brought down. Corporations are a collective who are treated as people when it's convenient and as something else when it's not. It's bothersome to me, because these corporations are tax sinks. They get absolutely massive tax breaks on everything they do and pay as little as possible income taxes, comparatively speaking, all the while keeping billions offshore. Billionaires and mega-corporations are national security threats to the countries that house them.
- octodog 4y ago
  Market cap is a measurement of value. GDP is a measurement of output. Comparing the two doesn't really make sense.
  - bmitc 4y ago
    Pick whatever comparison you'd like, and the rest of my comment still stands. What you said may be true, although I'm not sure it's as simple as you state. But debating the semantics of the exact comparison used isn't really important to the sentiment I espoused.
sharikous 4y ago
"state actors" doesn't mean the US government in its full force or any other government Apple is in bed with to make money (like China). It means in the best case shady agencies, foreign services, small governments, and in the likelier case just unhinged people with some access to state facilities (tax employees, unofficial police investigations, lawyers...)
rsync 4y ago
"It's the first such flag-raise I've seen." I was dripping with disdain and sarcasm as I clicked "reply" but I actually want to engage you and have you seriously consider the history of oil and gas exploration and extraction. This may, in fact, be a first for a US tech company ... but not in any way whatsoever a first for a business interest or corporation, etc. This is also a very tame, roundabout and implied flag-raise - as opposed to "... summary execution, crimes against humanity, torture, inhumane treatment and arbitrary arrest and detention ...": https://en.wikipedia.org/wiki/Ken_Saro-Wiwa#Family_lawsuits_against_Royal_Dutch_Shell https://en.wikipedia.org/wiki/Ken_Saro-Wiwa#Family_lawsuits_...
- the_other 4y ago
  Good points. I had not thought about oil at all. I’ve become aware through light skimming that wars, coups and similar incursions have occurred around other resources. This feeds into the point I was aiming at. The tech megacorps now have tooling to protect a narrow aspect of their customers lives from state incursion, regardless of which country that customer live in. I’ve not read the link you shared yet, so I don’t know the angle it takes or the angle you want to dig into my ideas from. Thanks for sparing me the satcasm.
Chris2048 4y ago
They don't "operate at the same level as nation states", protecting against state actors isn't the only thing in that level, unless you mean cyber-security only. Abstracting this to anything "nation-state level entity" is the crux of your argument.
seanw444 4y ago
I dislike big tech as much as the next hacker, but this seems like quite a leap. Protecting from nation-state actors digitally can be a job for digital powerhouses. In this case, the hackers are just very determined hackers with a lot of resources. Apple is a very motivated company with a lot of resources. Slightly to your point though, they have higher income than 96% of the countries on the planet. So they have the wealth to establish an Appletopia.
n0on3 4y ago
What they are doing is giving users an easy-to-use option to sacrifice part of the default user experience to enhance security by disabling features that are common vectors (which happen to be used by, as they phrase it multiple times in the announcement, "private companies developing state-sponsored mercenary spyware"). IMHO, whatever the reason why they are doing it, it's a good addition to their value proposition; but I don't think it's the same as what appears to be your understanding ("they will protect users from state actors"), at all.

ivraatiems 4y ago

The NSO Group, whom Apple specifically cites as an opponent that inspired this work, is a private corporation. They sell to governments, but so does Apple. The relationship between state and private industry has never been binary and has always had features like this. I don't think this is a "Jennifer Government" type scenario.

thehappypm 4y ago
NSO is pseudo-private, kind of like Raytheon.
- dfc 4y ago
  Raytheon (NYSE:RTX) is a publicly traded corporation.
  - thehappypm 4y ago
    My point is not public vs private structure, it’s that Raytheon is essentially a government entity at this point

bsedlm 4y ago

agreed, the rise of the corporation as the most powerful institution (above the nation-state) in this new budding global civilization is a long time coming. on the other hand, this is how democracy dies. what structures (systems) exist to prevent apple (and other comparable corporations) from being an oppresive force against human persons? moreover, what incentives do they have?

kube-system 4y ago
Corporations definitely have a lot of power today, but nothing more than they've had in the past. https://en.wikipedia.org/wiki/Company_rule_in_India https://en.wikipedia.org/wiki/Company_rule_in_India
scottyah 4y ago
To be fair, banks have been more powerful than a lot of nation-states for awhile, and religious entities before that.
- atlasunshrugged 4y ago
  The religious entities I get the argument but what banks have been more powerful than nation states?
  - bsedlm 4y ago
    the ones that only service other banks hence only people working in higher level banking are likely to have heard about. e.g. the bank for international settlements I only found out about this bank because the former president of the mexican central bank -- Mr. Carstens, left the central banking gig to go to that bank.
    - atlasunshrugged 4y ago
      From reading their Wikipedia quickly sounds like BIS has a similar function to say the IMF when it comes to financial system stability. I do agree these sorts of organizations exert huge amounts of influence, especially for smaller countries that are dependent on loans and outside financing, but I'm not sure I agree they are more powerful than a nation itself. A nation can (theoretically) decide to opt out from these systems and operate independently, or can play different parties funded by nations (because in the end they all are working for someone's agenda) off of one another as many countries did during the cold war between the U.S. and Soviet Union. But if a nation reneges on its debt, the BIS, IMF, etc. isn't going to invade your country--one of it's creditor nations might, but not them.

axolotlgod 4y ago

Definitely very interesting. I know Google has their “Advanced Protection Program”[0] with a Titan security key which is similar. It is interesting considering that Google’s protections target the user as the weak link, as your data lives on their hardware; while Apple is obviously targeting both the user and the hardware they have. I’m curiuos what security researchers will think of this, if it’s more theater or if it is actually a innovative attempt at giving advanced privacy to people who need it. Despite their past stumbles (e.g., CSAM), it seems like Apple is genuinely in the privacy fight, even if it is just for their bottom line. [0]: https://landing.google.com/advancedprotection/faq/ https://landing.google.com/advancedprotection/faq/

alwillis 4y ago
"About Apple threat notifications and protecting against state-sponsored attacks": https://support.apple.com/en-us/HT212960 https://support.apple.com/en-us/HT212960

legalcorrection 4y ago

I think you're letting the reality distortion field get to your head. They're creating a safe mode for iPhones because a lot of features complex/intricate enough that they are perennial sources of vulnerabilities (and/or UX flaws that lead users to make unsafe decisions). That is, they're turning features off for security. Something every IT department has been doing for decades. Windows supports this. Mac OS supports this. In fact, iOS was kind of notable in being so unconfigurable. The settings available in their MDM implementation were pitiful and didn't let admins disable many of these features.

saagarjha 4y ago
One difference is that Apple is actually quite good at understanding which features get exploited in zero-click attacks and IT departments are not.

newaccount2021 4y ago

Swizec 4y ago

> Apple is saying "we operate at the same level as nation states; we are a nation-state level entity operating in the "digital world" Apple's profits are bigger than my country's (Slovenia) whole GDP. You bet your butt they're a state level actor in the digital world. They have more resources than many countries. If Apple was a country, their $365bn in revenue would make them the 43rd richest country in the world right after Hong Kong. https://en.wikipedia.org/wiki/List_of_countries_by_GDP_(nominal) https://en.wikipedia.org/wiki/List_of_countries_by_GDP_(nomi...

amelius 4y ago
And if you computed the per-capita GDP?
- Swizec 4y ago
  Hard to compute because contractors don't count towards Apple's official headcount. Comes out to $2.5mil/employee using wikipedia numbers. GDP per capita for Slovenia is $25,179 in comparison. 100x less. For Hong kong, which makes a bit more GDP than Apple does revenue, the per capita number is $46,323. 50x less than Apple.
  - whateveracct 4y ago
    Also silly to compare because a proper nation-state does more than develop products and services for profit. Social contract and all that.
    - Swizec 4y ago
      My understanding is that the "social contract" inside many of these large companies is quite cushy. Especially in USA where being employed comes with services traditionally provided by the state like health care, child care, free or subsidized food, retirement benefits, etc.
      - whateveracct 4y ago

whatgoodisaroad 4y ago

At the same time, if that state actor happens to be China, Apple will just give the government access to your iCloud data. Not all state actors are equally within Apple's striking range.

milesskorpen 4y ago
If you opt-in to iCloud, you're opting in to a lot of state-level security risk in any country (and this is true of any commercial cloud).
- KennyBlanken 4y ago
  Nothing stops Apple from offering e2ee backups, and in fact they do this for certain data backed up to iCloud (health data for example.) But your iMessage data...well there, your ass is hanging out in the breeze. In fact, I'm not sure it's possible to log into an iPhone with your Apple ID and not have an iCloud backup immediately fire off, which means your private encryption keys hit iCloud and stay there until it is purged according to their data retention policies. And we have no idea what those policies actually are; those keys made end up stored forever.
  - GeekyBear 4y ago
    > Nothing stops Apple from offering e2ee backups The US Government pressured them to drop a plan for fully encrypted cloud backups. >Apple dropped plan for encrypting backups after the FBI complained https://www.reuters.com/article/us-apple-fbi-icloud-exclusive/exclusive-apple-dropped-plan-for-encrypting-backups-after-fbi-complained-sources-idUSKBN1ZK1CT https://www.reuters.com/article/us-apple-fbi-icloud-exclusiv... If you want a fully encrypted backup of your device, you have to make it to your local Mac or Windows computer.
  - thewebcount 4y ago
    > I'm not sure it's possible to log into an iPhone with your Apple ID and not have an iCloud backup immediately fire off Yes, it absolutely is possible. I have never turned on iCloud backup so I have no cloud backups of any of my phones or other devices.

KennyBlanken 4y ago

Apparently that protection does not include protection from the US government. iMessage offers excellent privacy of message content, but no 'pen register' protection. Phone device security is very strong, but it's made largely moot if you turn on iCloud backups (which is the default behavior if you provide an Apple ID. I'm not sure there's even a way to stop the initial backup from happening?) Apple reportedly doesn't offer e2ee on iCloud, or even encrypted device backups, out of compromise with the federal government...specifically the FBI, CIA, and NSA. Why might people care about this? Criminalizing abortion and miscarriages...and what looks like at the very least a re-recognizing, and possibly criminalization, of LGBTQ relationships.

eastbound 4y ago
True, Apple could stop nagging about backing up into iCloud. Apple should offer other sorts of backups, and offline iCloud systems.
- threeseed 4y ago
  They do offer other sorts of backups. You can backup to a Mac or PC. And it's offline and encrypted.
kube-system 4y ago
When Apple says "state actor threats" they're not talking about future-state theoretical breaches of domestic privacy by your own government. Apple is always going to follow the law. They're talking about the types of situations where data from people's phones is used to commit international criminal activity, espionage, assassinations, etc.
germandiago 4y ago
I know it is a very polemic topic but I genuinely think abortion is a crime, not a right. Not anything against LGBTQ or the like, though.

spamfilter247 4y ago

Microsoft has a “Democracy Forward” team (previously called “Defending Democracy”) that aims to protect government officials and systems from adversarial state actors. It’s been ongoing for a few years now. https://www.microsoft.com/en-us/corporate-responsibility/democracy-forward https://www.microsoft.com/en-us/corporate-responsibility/dem...

seanw444 4y ago
Given their track record, I'd trust Microsoft approximately 0% to secure my critical/sensitive systems. The funny thing is that the U.S. government does, in fact, trust them.

kmeisthax 4y ago

There's a bit of a journey from "protecting you against government hackers and spooks" to full-on sovereign states; and there's a lot of things that a country's government funds that Apple couldn't even begin to take on[0]. Physical security and military operations are a hell of a different field from that of locking down computers. Furthermore this isn't the first of its kind; Google has been alerting high-risk Gmail users about state-sponsored hacking for about a decade now. Microsoft probably does something similar. Apple is comparatively late to the party on this. On the offensive side you have the zero-day vendors that broker exploits between hackers and the government. A better explanation is that Apple isn't supplanting the US government. It's supplanting Halliburton. As more and more people and things go online, hacking and doxxing them is becoming more militarily valuable than just arresting someone or firing a missile. After all, physical attacks risk counterattacks and escalation, but Internet attacks are relatively cheap, not really treated as an attack by many sovereign states, and, most importantly, difficult to attribute. [0] Call me when Apple black-bags Louis Rossman for illegally repairing MacBooks, or threatens literal nuclear war - like, with uranium bombs and radioactive fallout - on the EU for breaking the App Store business model.

lwswl 4y ago
I've always thought that the companies coded the "zero day exploits" in, and then sold them for profit.
- ivraatiems 4y ago
  I'm not saying it never happens, and I don't want to assume anything about your background, but I think most people who work in software would agree there's no need. Plenty of problems get in on their own.
  - dylan604 4y ago
    RSA weaker key set to default perhaps?
  - skrtskrt 4y ago
    yep if that were your goal it would be way more cost effective to get a zero day from just not trying that hard with security practices. Not having any security knowledge on the team. Not patching/upgrading dependencies with security bugs.

starwind 4y ago

> Apple are saying "we will protect you from state actors", which is a role usually performed by states Not to sound flippant, but defense attorneys do this, too. I don't think it's as big a zeitgeist as you think

the_other 4y ago
Good to know. I think Apple's announcement (and as I've learned from this thread MS's and Google's similar programmes) represent a significant step-change. A single defense attorney performs this action on a case-by-case basis, and they earn "single human" levels of income from it. They (to some degree) use that money to make themselves comfortable and perhaps share it with charities and make investments. All the defense attorney's in the world combined still, probably, have access to a fraction of Apple's budget, and a fraction of Apple's audience. Defence attorneys don't always win all their cases. Apple have the kind of money that makes 1000s of attorneys envious. Apple use that money to make infrastructure and client devices and then sell/share that technology with billions of people. Most of Apple customers buy their phones on loan agreements over some contract time-frame. It's "cheap", and the protections are automated. I'm tired and getting rambly about this now, but I intuitively feel like the combination of state-level power (albeit exercised with a very narrow focus), and the way so many people live their (digital) lives interacting with a "noosphere" that crosses international borders are facets of a complex phenomenon we have not witnessed before, and which will merge with other related facets and then emerge as something really different. I accept I'm getting very fuzzy in my thinking here. I'm leaning into my inner sci-fi author (who's not come out for 30years and wasn't too talented when it did).
- alwillis 4y ago
  Excellent points. I don’t think it has sunk in for most HN readers that every iPhone since iPhone 8, released in 2017, can upgrade to iOS 16 and get Lockdown Mode. Apple is providing some protection against state-level actors at scale--hundreds of million devices. That is a step change!

celdon25 4y ago

> Apple is saying "we operate at the same level as nation states; we are a nation-state level entity operating in the "digital world": It's a flag-raise Maybe. But these security “features” feel like things that should have been there from the beginning. Windows 11 has already had a much wider and deeper array of security options. Sure, it’s not mobile, but many of those security options would be unlikely to be needed against unsophisticated attacks. Flag-raise or marketing gimmick? You be the judge I guess.

ziddoap 4y ago

>Apple is saying "we operate at the same level as nation states; we are a nation-state level entity operating in the "digital world" Making mountains out of molehills. I'm pretty sure they are saying that they will "offer specialized additional protection to users who may be at risk of highly targeted cyberattacks from private companies developing state-sponsored mercenary spyware". There is a looooong list of things which nation states can do which Apple cannot, some examples of that are in other comments in this thread. >but this is the first public announcement, and tool, from a corporation with more spare, unrestricted capital than many countries. Google & Microsoft have both had fairly long-standing tools and procedures (which were publicly announced) to both alert users and aid users against nation state attacks.

alwillis 4y ago
Apple also started alerting people being targeted by state actors last year [1]. [1]: “About Apple threat notifications and protecting against state-sponsored attacks” https://support.apple.com/en-us/HT212960 https://support.apple.com/en-us/HT212960
sodality2 4y ago
Google's Advanced Protection program is the same: https://landing.google.com/advancedprotection/ https://landing.google.com/advancedprotection/

cma 4y ago

> It's the first such flag-raise I've seen. After the Snowden leaks that showed even in-country citizen-to-citizen communication was being scooped up by the NSA without a warrant through fiber taps (if I remember that right) when Google replicated the data to out-of-country data centers, Google announced encryption of those links: Google encrypts data amid backlash against NSA spying https://www.washingtonpost.com/business/technology/google-encrypts-data-amid-backlash-against-nsa-spying/2013/09/06/9acc3c20-1722-11e3-a2ec-b47e45e6f8ef_story.html https://www.washingtonpost.com/business/technology/google-en...

modeless 4y ago

> It's the first such flag-raise I've seen You haven't been paying attention. Many tech companies have been protecting accounts from state attackers for many years, and explicitly calling out state sponsored attacks. Google introduced state-sponsored attack warnings in 2012 [1] and the Advanced Protection program explicitly protects from state sponsored attacks [2]. [1] https://security.googleblog.com/2012/06/security-warnings-for-suspected-state.html https://security.googleblog.com/2012/06/security-warnings-fo... [2] https://blog.google/threat-analysis-group/protecting-users-government-backed-hacking-and-disinformation/ https://blog.google/threat-analysis-group/protecting-users-g...

alwillis 4y ago
Many tech companies have been protecting accounts from state attackers for many years… How many people have Microsoft and Google actually helped? Incase you didn’t notice, Apple is in the process of giving a few hundred million iPhone owners--every iPhone since the 2017 iPhone 8--protection from state-level actors, for free, in the next operating system update due this fall. It totally dwarfs anything that any other company has done in this area. So there’s that.
- modeless 4y ago
  Google sent more than 50,000 state sponsored attack warnings in 2021. And those warnings started in 2012. So a lot of people have been helped. Meanwhile Apple didn't start doing similar warnings until less than a year ago. > Apple is in the process of giving a few hundred million iPhone owners Um, no? Lockdown mode is explicitly for "very few users". There's no way a hundred million iPhone users would benefit. Google's Advanced Protection offers protection from state-level actors to anyone with a Google account, so if you want to count by the number of people offered optional protection, Google wins by a landslide. > for free Haha, no, you have to buy an iPhone from Apple first. Google offers protection to anyone actually for free. All you need is a free Google account and a security key which doesn't have to be purchased from Google.
  - alwillis 4y ago

labrador 4y ago

Apple is following the lead of Microsoft in this regard. Microsoft has been acting as an international cyber defense agency for a few years. On the effectiveness of Ukraine's cyber defense: "Microsoft in particular has been hard at work" 21:45 Assessing Russia’s War in Ukraine https://youtu.be/CzbsPOaCrLw?t=1305 https://youtu.be/CzbsPOaCrLw?t=1305

marcodiego 4y ago

Since the software is still proprietary, considering these statement as guarantees is just an exercise of faith.

stefan_ 4y ago

I think you need to put away the pipe, this is Apple saying "we can't make JIT work safely so here's an option to turn it off".

alwillis 4y ago
This is more like “there are always going to be zero-day exploits out there and until we can fix them, this is the next best thing."
threeseed 4y ago
> Apple saying "we can't make JIT work safely so here's an option to turn it off" To be fair has anyone made it work safely ?

LegitShady 4y ago

Counterpoint - the EU has been passing laws that force apple to be more fair in their markets, and this "we're protecting you from bad guys" stuff is apple trying to figure out deniable methods to protest or sue against the EU passing laws to restrict apple's ability to lock other developers out. Throw together a basic set of options that should have been available long ago, now apple is protecting you, don't strip apple of the ability to protect you, etc.

atmosx 4y ago

Nothing new. When states requested access to covid DB apple and Google refused access based on what happened in the Netherlands in WW2. I must that on one hand it’s anti-democratic, on the other hand western democracies have a rather poor track record on safeguarding this kind of info.

unethical_ban 4y ago

No, they aren't, any more than an OS claiming "military grade encrypted boot drive" means they have a military.

germandiago 4y ago

This is good news IMHO because it encourages that companies compete for the best offer in that space as they go. In some way it reminds me (with all the differences!) of how things like cryptocurrencies could remove the state from a monopoly. Good news for me this announcement!

dotnet00 4y ago

This feels like an argument the government would make against strong encryption like in the case a few years ago where the government tried to force Apple to unlock an iPhone and Apple refused claiming it wasn't possible. Apple are basically saying that they're going to do their best in terms of security measures to thwart even state actors, which is only as much of a nation-state level thing as "military grade encryption" is a thing only applicable to militaries.

moogly 4y ago

> It's the first such flag-raise I've seen Zuckerberg, 5 years ago: https://www.youtube.com/watch?v=mFPAe8Tc2NE https://www.youtube.com/watch?v=mFPAe8Tc2NE

foobiekr 4y ago
Perhaps "first credible" is the correct description.
- moogly 4y ago
  I'm not so sure about that; I'm not that impressed by that list of features.

jiveturkey 4y ago

> It's the first such flag-raise I've seen. “Flag-raise” seems a bit hyperbolic but at any rate I think the BSA asserted such reach and power, long ago. Both have to act within the oversight of actual nation states. Beyond that, a secure phone is necessary but not sufficient to defend oneself against a nation state.

mnd999 4y ago

Do you also believe the earth is flat?

wyuenho 4y ago

A nation state has more than one way of extracting information from enemies of said state. There's the civilized way we now call hacking, and then there's the traditional way, which may or may not involve technology.

time_to_smile 4y ago

I don't know if you've been paying attention to Apple's strategy over the last year, but it's basically been "granting user privacy also happens to grant us an advertising/data monopoly" I don't think the aim here is to block at state actors but to basically continue to close all security holes that can be exploited by any other company and continually proving to users that Apple cares about privacy. The things is I really like Apple even more now since they have realize that my privacy interests can be tightly aligned with their own economic interests. I never trust companies to be good or look out for my interest even when I pay them to, but when my privacy ultimately means they gain a very strong competitive edge the I'm much more trusting. Apple has realized they can become to privacy what Google has been to ubiquitous search, and doing so can reap even larger and more secure rewards. They started with a walled garden and now extending it to fortress surrounding the garden.

happyopossum 4y ago
> advertising/data monopoly not to be glib, but 'citation please?' Other than running ads inside the App Store, do you have any knowledge or evidence of Apple collecting personal information for advertising or any other use?

kccqzy 4y ago

Google has been dealing with nation state actors targeting its users (Gmail specifically) for a decade now. They have Advanced Protection program. We actually regularly used to hear about how human rights activists were targeted in spear phishing campaigns and then arrested. https://landing.google.com/advancedprotection/ https://landing.google.com/advancedprotection/

the_gipsy 4y ago

It's marketing and you ate the hook, line, and sinker.

lolbutwutf 4y ago

Apple blocking a few features means it's now operating as a nation state. Tell me it's a Hacker News comment without telling me it's a Hacker News comment.

bmitc 4y ago

> from a corporation with more spare, unrestricted capital than many countries ... than most countries. There are only 7 countries with a higher GDP than Apple's market cap. I have been concerned for some time about these mega corporations being as powerful if not more powerful than governments. They wield tremendous economic and political power. Corporations have very little allegiance to countries and have little to check them. It is a major concern of mine. Democracy in the U.S. is already being sold to the highest bidders. These corporations are feudal lords but much, much more powerful because there is not a single person who can be brought down. Corporations are a collective who are treated as people when it's convenient and as something else when it's not. It's bothersome to me, because these corporations are tax sinks. They get absolutely massive tax breaks on everything they do and pay as little as possible income taxes, comparatively speaking, all the while keeping billions offshore. Billionaires and mega-corporations are national security threats to the countries that house them.

octodog 4y ago
Market cap is a measurement of value. GDP is a measurement of output. Comparing the two doesn't really make sense.
- bmitc 4y ago
  Pick whatever comparison you'd like, and the rest of my comment still stands. What you said may be true, although I'm not sure it's as simple as you state. But debating the semantics of the exact comparison used isn't really important to the sentiment I espoused.

sharikous 4y ago

"state actors" doesn't mean the US government in its full force or any other government Apple is in bed with to make money (like China). It means in the best case shady agencies, foreign services, small governments, and in the likelier case just unhinged people with some access to state facilities (tax employees, unofficial police investigations, lawyers...)

rsync 4y ago

"It's the first such flag-raise I've seen." I was dripping with disdain and sarcasm as I clicked "reply" but I actually want to engage you and have you seriously consider the history of oil and gas exploration and extraction. This may, in fact, be a first for a US tech company ... but not in any way whatsoever a first for a business interest or corporation, etc. This is also a very tame, roundabout and implied flag-raise - as opposed to "... summary execution, crimes against humanity, torture, inhumane treatment and arbitrary arrest and detention ...": https://en.wikipedia.org/wiki/Ken_Saro-Wiwa#Family_lawsuits_against_Royal_Dutch_Shell https://en.wikipedia.org/wiki/Ken_Saro-Wiwa#Family_lawsuits_...

the_other 4y ago
Good points. I had not thought about oil at all. I’ve become aware through light skimming that wars, coups and similar incursions have occurred around other resources. This feeds into the point I was aiming at. The tech megacorps now have tooling to protect a narrow aspect of their customers lives from state incursion, regardless of which country that customer live in. I’ve not read the link you shared yet, so I don’t know the angle it takes or the angle you want to dig into my ideas from. Thanks for sparing me the satcasm.

Chris2048 4y ago

They don't "operate at the same level as nation states", protecting against state actors isn't the only thing in that level, unless you mean cyber-security only. Abstracting this to anything "nation-state level entity" is the crux of your argument.

seanw444 4y ago

I dislike big tech as much as the next hacker, but this seems like quite a leap. Protecting from nation-state actors digitally can be a job for digital powerhouses. In this case, the hackers are just very determined hackers with a lot of resources. Apple is a very motivated company with a lot of resources. Slightly to your point though, they have higher income than 96% of the countries on the planet. So they have the wealth to establish an Appletopia.

n0on3 4y ago

What they are doing is giving users an easy-to-use option to sacrifice part of the default user experience to enhance security by disabling features that are common vectors (which happen to be used by, as they phrase it multiple times in the announcement, "private companies developing state-sponsored mercenary spyware"). IMHO, whatever the reason why they are doing it, it's a good addition to their value proposition; but I don't think it's the same as what appears to be your understanding ("they will protect users from state actors"), at all.