3 ms·

Apple gives data to the United States government on over 70,000 user accounts per year without a warrant. Anything Apple knows, the FBI can know, without proba

by sneak 2y ago

Apple gives data to the United States government on over 70,000 user accounts per year without a warrant. Anything Apple knows, the FBI can know, without probable cause.

nickburns 2y ago
Not doubting this whatsoever, but what are you citing here?
- sneak 2y ago
  Apple’s own transparency report. Look at the FISA (FAA702, aka Prism) section. Per the Snowden slides, this (FAA702 collection) is the #1 most used collection method by US spies. They can basically read approximately every camera roll and iMessage in the country with a few clicks.
  - kdmtctl 2y ago
    So, seems that E2E is a total bullshit then?
    - nickburns 2y ago
      Only if it's backdoored (or otherwise breakable).
    - sneak 2y ago
      iMessage e2ee is bullshit because iCloud Backup e2ee is opt-in, and approximately 0% of Apple’s user base has turned it on, making iCloud Backup non-e2ee in practice. All of the iMessage access data (either the iMessages themselves or the iMessage sync key for “Messages in iCloud”) is stored in the non-e2ee iCloud Backup. This means that the iMessage service e2ee is meaningless because the iMessages themselves are not e2ee. Note well that turning on iCloud e2ee is insufficient, as everyone else that you iMessage with will still have it off, and all of your iMessages will still be backed up non-e2ee to Apple in their device backups. Having iCloud e2ee available is the best of both worlds for Apple: they can say that it’s available for privacy-conscious users to opt into, while still being able to turn over basically 100% of all iMessages to the feds whenever they ask.
      - kdmtctl 2y ago
        Sorry. Didn't get it. So, if iMessages IS e2ee (supposedly) and someone properly makes iCloud backups e2ee (supposedly), how the Feds will break it? I do understand the counterpart party problem, it is not someone can control. Sent once, it's free to be seen by anyone.
        nickburns 2y ago
        Nobody has suggested that anyone, Feds included, has the present technical capability to break any of the security levels that are in widescale E2EE usage today.
        sneak 2y ago
        If both you and the iMessage counterparty both have e2ee enabled for iCloud Backup, it's unlikely at present that the feds can read the messages without a warrant under FAA702 "foreign" intelligence collection (which as we now know thanks to Snowden is routinely used against even Americans). With an actual warrant or wiretap order, there is no guarantee that Apple can't or won't insert additional endpoint keys into the conversation. But, that said, 99.9%+ of users don't have e2ee enabled for iCloud Backup, so the e2ee in iMessage is mostly irrelevant, and it's available in full to the feds at any time, no warrant required. tl;dr: use Signal.
singleshot_ 2y ago
To be clear, tech companies provide subscriber metadata (e.g., billing address, real name) with a court order or subpoena. They provide actual user data (e.g., voicemail) only with a warrant. Or has something changed since the last time I requested user data from a tech company by subpoena? Or are you talking about intelligence collection as distinct from law enforcement? Also worth noting that LE frequently has PC without having a warrant (for example: every time they ask a magistrate for a warrant and secure one, we can infer they had PC first). In fact they perform many searches with only PC (see: exigency, eventual discovery, etc). It would be more apt to say any subscriber metadata Apple knows, the FBI can know without a warrant.
- sneak 2y ago
  This is false. FAA702 collection provides full content. This was disclosed by Edward Snowden; the internal codename for such collection is PRISM. The line between foreign intelligence collection and domestic law enforcement no longer exists. This is why parallel construction is so common today.
  - singleshot_ 2y ago
    I do not agree with your last two sentences but greatly appreciate the quick reply.
  - nickburns 2y ago
    Outrageous and (obviously) unconfirmed claims. But again, and as an American whose private data should never fall under the purview of FISA or FAA or any other IC intelligence gathering activities, I don't seriously doubt domestic US spying/surveillance capabilities. That LE has to feign the need for a warrant should the need arise to make lawfully admissible that which they already know and are in possession of is the most likely scenario. Encryption really is the only safeguard.

by sneak 2y ago

Apple gives data to the United States government on over 70,000 user accounts per year without a warrant. Anything Apple knows, the FBI can know, without probable cause.

nickburns 2y ago

Not doubting this whatsoever, but what are you citing here?

sneak 2y ago
Apple’s own transparency report. Look at the FISA (FAA702, aka Prism) section. Per the Snowden slides, this (FAA702 collection) is the #1 most used collection method by US spies. They can basically read approximately every camera roll and iMessage in the country with a few clicks.
- kdmtctl 2y ago
  So, seems that E2E is a total bullshit then?
  - nickburns 2y ago
    Only if it's backdoored (or otherwise breakable).
  - sneak 2y ago
    iMessage e2ee is bullshit because iCloud Backup e2ee is opt-in, and approximately 0% of Apple’s user base has turned it on, making iCloud Backup non-e2ee in practice. All of the iMessage access data (either the iMessages themselves or the iMessage sync key for “Messages in iCloud”) is stored in the non-e2ee iCloud Backup. This means that the iMessage service e2ee is meaningless because the iMessages themselves are not e2ee. Note well that turning on iCloud e2ee is insufficient, as everyone else that you iMessage with will still have it off, and all of your iMessages will still be backed up non-e2ee to Apple in their device backups. Having iCloud e2ee available is the best of both worlds for Apple: they can say that it’s available for privacy-conscious users to opt into, while still being able to turn over basically 100% of all iMessages to the feds whenever they ask.
    - kdmtctl 2y ago
      Sorry. Didn't get it. So, if iMessages IS e2ee (supposedly) and someone properly makes iCloud backups e2ee (supposedly), how the Feds will break it? I do understand the counterpart party problem, it is not someone can control. Sent once, it's free to be seen by anyone.
      - nickburns 2y ago
        Nobody has suggested that anyone, Feds included, has the present technical capability to break any of the security levels that are in widescale E2EE usage today.
      - sneak 2y ago
        If both you and the iMessage counterparty both have e2ee enabled for iCloud Backup, it's unlikely at present that the feds can read the messages without a warrant under FAA702 "foreign" intelligence collection (which as we now know thanks to Snowden is routinely used against even Americans). With an actual warrant or wiretap order, there is no guarantee that Apple can't or won't insert additional endpoint keys into the conversation. But, that said, 99.9%+ of users don't have e2ee enabled for iCloud Backup, so the e2ee in iMessage is mostly irrelevant, and it's available in full to the feds at any time, no warrant required. tl;dr: use Signal.

singleshot_ 2y ago

To be clear, tech companies provide subscriber metadata (e.g., billing address, real name) with a court order or subpoena. They provide actual user data (e.g., voicemail) only with a warrant. Or has something changed since the last time I requested user data from a tech company by subpoena? Or are you talking about intelligence collection as distinct from law enforcement? Also worth noting that LE frequently has PC without having a warrant (for example: every time they ask a magistrate for a warrant and secure one, we can infer they had PC first). In fact they perform many searches with only PC (see: exigency, eventual discovery, etc). It would be more apt to say any subscriber metadata Apple knows, the FBI can know without a warrant.

sneak 2y ago
This is false. FAA702 collection provides full content. This was disclosed by Edward Snowden; the internal codename for such collection is PRISM. The line between foreign intelligence collection and domestic law enforcement no longer exists. This is why parallel construction is so common today.
- singleshot_ 2y ago
  I do not agree with your last two sentences but greatly appreciate the quick reply.
- nickburns 2y ago
  Outrageous and (obviously) unconfirmed claims. But again, and as an American whose private data should never fall under the purview of FISA or FAA or any other IC intelligence gathering activities, I don't seriously doubt domestic US spying/surveillance capabilities. That LE has to feign the need for a warrant should the need arise to make lawfully admissible that which they already know and are in possession of is the most likely scenario. Encryption really is the only safeguard.