10 ms·

Yet no comment from them about what being a "provider" under PRISM entails. * "In addition, Apple has never worked with any government agency from any country

Yet no comment from them about what being a "provider" under PRISM entails. * "In addition, Apple has never worked with any government agency from any country to create a “back door” in any of our products or services." If Apple provides an interface to request user-data to law enforcement / NSA, that's not a back door in the product or the service. * "We have also never allowed any government access to our servers. And we never will." If they provide user-data after being served with a warrant (possibly through email or to their legal department), their servers were never accessed, yet the data was provided. It's always interesting to read what is and isn't said. Word games, I swear.

droopyEyelids 12y ago
I'd like to see a breakdown of exactly what they can provide with a device request and an account request. I think that would be reasonable information to share, because it'd educate both law enforcement and the general public about what data is available from their devices. Plus it'd settle the issue of word games- or at least bring it closer to being settled in my eyes. We can't get a good idea of what is going on with these 10k foot marketing pronouncements.
- antmldr 12y ago
  http://images.apple.com/privacy/docs/legal-process-guidelines-apac.pdf http://images.apple.com/privacy/docs/legal-process-guideline... Page 4 onwards provides a list of information they provide to law enforcement agencies. Probably prudent if you're an apple customer to simply assume all of this information is as good as public.
  - joosters 12y ago
    I. Extracting Data from Passcode Locked iOS Devices ... For all devices running iOS 8.0 and later versions, Apple will no longer be performing iOS data extractions as the data sought will be encrypted and Apple will not possess the encryption key. Interesting. What changed in iOS 8, I wonder?
  - arrrg 12y ago
    Law enforcement access is not the same as public access. I think it is extremely important to make that distinction. And there is one.
declan 12y ago
>If they provide user-data after being served with a warrant their servers were never accessed, yet the data was provided. Yes, that's true. But if you run an email service that's based in Cupertino, what do you do when served with a lawful search warrant or wiretap order? Say "no," and be found in contempt of court and have all your servers carted away by some men in black so they can find the file they're looking for? There are a few ways around this. One is not to permanently store warrant-worthy user data (Snapchat, Wickr, etc.). Another is end-to-end encryption (original version of Hushmail), though key distribution and UX become problems. A third is to move your servers to Switzerland, though then you get served with process from the Swiss authorities instead of FBIDHSDEAetc. Apple has taken none of these steps. Assume our hypothetical Cupertino-based email service has not either. What do you do when the Feds show up with a lawful order?
- Yver 12y ago
  > What do you do when the Feds show up with a lawful order? I don't expect them to say no. That's why I don't expect them to imply that they would or suggest that they never have.
- mkal_tsr 12y ago
  I go under the assumption that if I'm not the one generating and providing the encryption keys (and really, pre-encrypting the data), absolutely nothing is secure/encrypted. And in all honesty, if it touched the internet, it's already insecure to some extent. It's been "fun" to read Jewel vs. NSA proceedings, press statements, and officials' statements about these issues because of the extent to which they play word games to technically not lie according to specific (re)definition of words.
  - antimagic 12y ago
    Why stop there? If you're not root, you're not secure either. For example, if someone else is root, they can do whatever they want with your locally generated keys, upto and including sending them to the NSA with a little bow on top. Even if you are root it's no guarantee, thank you rootkits :/ As with all things security, sometimes it comes down to trust and legal protections.
snowwrestler 12y ago
Apple has directly addressed the PRISM diclosures, last year: https://www.apple.com/apples-commitment-to-customer-privacy/ https://www.apple.com/apples-commitment-to-customer-privacy/ In addition the new section launched today includes a page on government information requests, including "National Security Orders from the U.S. government." One sentence summary: they provide data to the government when required to by law. PRISM itself is a program that is structured as a request/response, and the requests are approved by the FISA court, so it would fit into Apple's language in that section. The initial report of PRISM implied that the NSA and FBI had direct, unfettered access to providers' "central servers", but that has been since walked back a bit. The points of concern with PRISM are 1) poor oversight from the FISA court, 2) overly broad request criteria resulting in huge datasets collected, and 3) the lack of public oversight due to gag orders.
- davedx 12y ago
  > The initial report of PRISM implied that the NSA and FBI had direct, unfettered access to providers' "central servers", but that has been since walked back a bit. Really? I haven't been able to follow every report, as the Snowden leaks generated a lot of content over the past year. Can you give a source to where PRISM's central server access has been "walked back a bit"?
  - nikcub 12y ago
    http://www.forbes.com/sites/jonathanhall/2013/06/07/washington-post-updates-hedges-on-initial-prism-report/ http://www.forbes.com/sites/jonathanhall/2013/06/07/washingt...
  - snowwrestler 12y ago
    The Wikipedia page is up to date and contains a lot of links to external sources. http://en.wikipedia.org/wiki/PRISM_%28surveillance_program%29 http://en.wikipedia.org/wiki/PRISM_%28surveillance_program%2... The press report that most directly addresses the issue is probably this one: http://www.cnet.com/news/no-evidence-of-nsas-direct-access-to-tech-companies/ http://www.cnet.com/news/no-evidence-of-nsas-direct-access-t... Incidentally the author of that story is doing a startup now, visits HN, and actually has posted in this thread! Username is "declan." Essentially, it seems there are a number of NSA programs that we can now distinguish from one another. PRISM uses the FBI and FISA court orders to directly request records from hosted application providers like Google, Yahoo, Apple, etc. But there are also other programs that claim to be authorized under the FISA law that target network infrastructure companies like Verizon and AT&T, apparently sucking up and storing huge amounts of raw traffic directly from network infrastructure. This would be the famous "secret room" at AT&T network building in California. These could suck up Apple traffic (or anyone else) but Apple would not be aware because it's at the network layer. Then there is MUSCULAR, in which the NSA helped the British GCHQ hack into the internal networks of Google (without Google's knowledge) to suck data out of the unencrypted connections between Google servers.
emsy 12y ago
There are interviews were Tim Cook states the range of warrant requests (he isn't allowed to tell the exact numbers): http://www.youtube.com/watch?v=Bmm5faI_mLo http://www.youtube.com/watch?v=Bmm5faI_mLo Seemingly, they also have some sort of canary in place in case they get secret requests under the patriot act: http://boingboing.net/2013/11/05/apple-hides-a-patriot-act-bust.html http://boingboing.net/2013/11/05/apple-hides-a-patriot-act-b...
- rtpg 12y ago
  I highly doubt the canary would be a valid defence. By omitting the line you are, for most intents and purposes, saying that you received a request. Now, saying you received a request and saying specifically what request you received are different, but I imagine the gag order doesn't make that differentiation. Gag order is not that you can't say a specific thing, it's that you can't communicate a specific piece of information. The canary is communicating something. A court order can ask you to lie, so the "I can't lie to my customers" defence probably won't work.
- UVB-76 12y ago
  If you look at the transparency reports, only the report for the first half of 2013 includes that canary (specifically mentioning Section 215). It was removed for the latter half of 2013, and this just-released first half of 2014 report. Take that as you will.
MCRed 12y ago
> If Apple provides an interface to request user-data to law enforcement / NSA, that's not a back door in the product or the service. I consider that a back door. >We have also never allowed any government access to our servers. And we never will Makes it clear what he means in the first statement. I've known Apple to engage in hyperbole to a significant degree, but never -- in nearly 40 years-- to lie publicly. They haven't denied providing information under warrant. Basically, every US company is going to do that. But that's on a case by case basis, not wholesale.
- mkal_tsr 12y ago
  An interface to request data wouldn't be a back door, as that falls under the "request/response" model. "Here is our warrant for Person X by judge Y in district Z" != "sudo apple-get * /mount/nsa" The important distinction there is that each request is an individual request and can't be automated / done in bulk / wholesale. I'm very interested to see how the device vs. account data-request ratio maintains/changes with the release and adoption of iOS 8.
jwr 12y ago
I find it amusing that people are being outraged at Apple, instead of being outraged at their government. From outside the US, it looks like it became generally accepted that the NSA will spy on US citizens all it wants, unchecked, and there is nothing anyone can do about it. Instead, all the rage is getting directed at companies that disclose the information to NSA.
- deleted 12y ago
  [deleted]
- Drakim 12y ago
  Often it seems like the people want businesses to take up the fight for privacy, rather than the people themselves.
  - enneff 12y ago
    And why not? Businesses, through lobbying, essentially control the US government. It's not unreasonable that American citizens might feel more empowered voting with their dollars than with ballot papers.
    - happyscrappy 12y ago
      People don't care about privacy or they wouldn't be using Android.
    - ilobby 12y ago
      Excellent point. So do it. iLobby.co
    - ilobby 12y ago
      It was about three $3.2 billion last year in 2013 from the federally registered lobbyists. The state level is probably equal to that. Some think the real numbers are closer to $9 billion at the federal level because PR and consulting don't have to be filed with the Senate clerk. https://www.opensecrets.org/lobby/ https://www.opensecrets.org/lobby/
  - 12y ago
NamTaf 12y ago
You're forgetting that for all the Snowden leaks have revealed, the info in the press about Prism is still classified. IANAL, but I would imagine Apple could get smacked quite a bit if it started talking about its cooperation (not necessarily voluntary cooperation, that is) with NSA initiatives like Prism. I mean when the wikileaks cable dump came out, there was quite a bit of noise about how US government people should not visit the site because it would still constitute a breach of security even though it was in the public domain, and that they could lose their jobs for it. This is no different, really. The material is still classified whether it's spread all over the press or not, so discussing it with uncleared persons such as the public would (IANAL, again) I imagine be a breach of security.

droopyEyelids 12y ago

I'd like to see a breakdown of exactly what they can provide with a device request and an account request. I think that would be reasonable information to share, because it'd educate both law enforcement and the general public about what data is available from their devices. Plus it'd settle the issue of word games- or at least bring it closer to being settled in my eyes. We can't get a good idea of what is going on with these 10k foot marketing pronouncements.

antmldr 12y ago
http://images.apple.com/privacy/docs/legal-process-guidelines-apac.pdf http://images.apple.com/privacy/docs/legal-process-guideline... Page 4 onwards provides a list of information they provide to law enforcement agencies. Probably prudent if you're an apple customer to simply assume all of this information is as good as public.
- joosters 12y ago
  I. Extracting Data from Passcode Locked iOS Devices ... For all devices running iOS 8.0 and later versions, Apple will no longer be performing iOS data extractions as the data sought will be encrypted and Apple will not possess the encryption key. Interesting. What changed in iOS 8, I wonder?
- arrrg 12y ago
  Law enforcement access is not the same as public access. I think it is extremely important to make that distinction. And there is one.

declan 12y ago

>If they provide user-data after being served with a warrant their servers were never accessed, yet the data was provided. Yes, that's true. But if you run an email service that's based in Cupertino, what do you do when served with a lawful search warrant or wiretap order? Say "no," and be found in contempt of court and have all your servers carted away by some men in black so they can find the file they're looking for? There are a few ways around this. One is not to permanently store warrant-worthy user data (Snapchat, Wickr, etc.). Another is end-to-end encryption (original version of Hushmail), though key distribution and UX become problems. A third is to move your servers to Switzerland, though then you get served with process from the Swiss authorities instead of FBIDHSDEAetc. Apple has taken none of these steps. Assume our hypothetical Cupertino-based email service has not either. What do you do when the Feds show up with a lawful order?

Yver 12y ago
> What do you do when the Feds show up with a lawful order? I don't expect them to say no. That's why I don't expect them to imply that they would or suggest that they never have.
mkal_tsr 12y ago
I go under the assumption that if I'm not the one generating and providing the encryption keys (and really, pre-encrypting the data), absolutely nothing is secure/encrypted. And in all honesty, if it touched the internet, it's already insecure to some extent. It's been "fun" to read Jewel vs. NSA proceedings, press statements, and officials' statements about these issues because of the extent to which they play word games to technically not lie according to specific (re)definition of words.
- antimagic 12y ago
  Why stop there? If you're not root, you're not secure either. For example, if someone else is root, they can do whatever they want with your locally generated keys, upto and including sending them to the NSA with a little bow on top. Even if you are root it's no guarantee, thank you rootkits :/ As with all things security, sometimes it comes down to trust and legal protections.

snowwrestler 12y ago

Apple has directly addressed the PRISM diclosures, last year: https://www.apple.com/apples-commitment-to-customer-privacy/ https://www.apple.com/apples-commitment-to-customer-privacy/ In addition the new section launched today includes a page on government information requests, including "National Security Orders from the U.S. government." One sentence summary: they provide data to the government when required to by law. PRISM itself is a program that is structured as a request/response, and the requests are approved by the FISA court, so it would fit into Apple's language in that section. The initial report of PRISM implied that the NSA and FBI had direct, unfettered access to providers' "central servers", but that has been since walked back a bit. The points of concern with PRISM are 1) poor oversight from the FISA court, 2) overly broad request criteria resulting in huge datasets collected, and 3) the lack of public oversight due to gag orders.

davedx 12y ago
> The initial report of PRISM implied that the NSA and FBI had direct, unfettered access to providers' "central servers", but that has been since walked back a bit. Really? I haven't been able to follow every report, as the Snowden leaks generated a lot of content over the past year. Can you give a source to where PRISM's central server access has been "walked back a bit"?
- nikcub 12y ago
  http://www.forbes.com/sites/jonathanhall/2013/06/07/washington-post-updates-hedges-on-initial-prism-report/ http://www.forbes.com/sites/jonathanhall/2013/06/07/washingt...
- snowwrestler 12y ago
  The Wikipedia page is up to date and contains a lot of links to external sources. http://en.wikipedia.org/wiki/PRISM_%28surveillance_program%29 http://en.wikipedia.org/wiki/PRISM_%28surveillance_program%2... The press report that most directly addresses the issue is probably this one: http://www.cnet.com/news/no-evidence-of-nsas-direct-access-to-tech-companies/ http://www.cnet.com/news/no-evidence-of-nsas-direct-access-t... Incidentally the author of that story is doing a startup now, visits HN, and actually has posted in this thread! Username is "declan." Essentially, it seems there are a number of NSA programs that we can now distinguish from one another. PRISM uses the FBI and FISA court orders to directly request records from hosted application providers like Google, Yahoo, Apple, etc. But there are also other programs that claim to be authorized under the FISA law that target network infrastructure companies like Verizon and AT&T, apparently sucking up and storing huge amounts of raw traffic directly from network infrastructure. This would be the famous "secret room" at AT&T network building in California. These could suck up Apple traffic (or anyone else) but Apple would not be aware because it's at the network layer. Then there is MUSCULAR, in which the NSA helped the British GCHQ hack into the internal networks of Google (without Google's knowledge) to suck data out of the unencrypted connections between Google servers.

emsy 12y ago

There are interviews were Tim Cook states the range of warrant requests (he isn't allowed to tell the exact numbers): http://www.youtube.com/watch?v=Bmm5faI_mLo http://www.youtube.com/watch?v=Bmm5faI_mLo Seemingly, they also have some sort of canary in place in case they get secret requests under the patriot act: http://boingboing.net/2013/11/05/apple-hides-a-patriot-act-bust.html http://boingboing.net/2013/11/05/apple-hides-a-patriot-act-b...

rtpg 12y ago
I highly doubt the canary would be a valid defence. By omitting the line you are, for most intents and purposes, saying that you received a request. Now, saying you received a request and saying specifically what request you received are different, but I imagine the gag order doesn't make that differentiation. Gag order is not that you can't say a specific thing, it's that you can't communicate a specific piece of information. The canary is communicating something. A court order can ask you to lie, so the "I can't lie to my customers" defence probably won't work.
UVB-76 12y ago
If you look at the transparency reports, only the report for the first half of 2013 includes that canary (specifically mentioning Section 215). It was removed for the latter half of 2013, and this just-released first half of 2014 report. Take that as you will.

MCRed 12y ago

> If Apple provides an interface to request user-data to law enforcement / NSA, that's not a back door in the product or the service. I consider that a back door. >We have also never allowed any government access to our servers. And we never will Makes it clear what he means in the first statement. I've known Apple to engage in hyperbole to a significant degree, but never -- in nearly 40 years-- to lie publicly. They haven't denied providing information under warrant. Basically, every US company is going to do that. But that's on a case by case basis, not wholesale.

mkal_tsr 12y ago
An interface to request data wouldn't be a back door, as that falls under the "request/response" model. "Here is our warrant for Person X by judge Y in district Z" != "sudo apple-get * /mount/nsa" The important distinction there is that each request is an individual request and can't be automated / done in bulk / wholesale. I'm very interested to see how the device vs. account data-request ratio maintains/changes with the release and adoption of iOS 8.

jwr 12y ago

I find it amusing that people are being outraged at Apple, instead of being outraged at their government. From outside the US, it looks like it became generally accepted that the NSA will spy on US citizens all it wants, unchecked, and there is nothing anyone can do about it. Instead, all the rage is getting directed at companies that disclose the information to NSA.

deleted 12y ago
[deleted]
Drakim 12y ago
Often it seems like the people want businesses to take up the fight for privacy, rather than the people themselves.
- enneff 12y ago
  And why not? Businesses, through lobbying, essentially control the US government. It's not unreasonable that American citizens might feel more empowered voting with their dollars than with ballot papers.
  - happyscrappy 12y ago
    People don't care about privacy or they wouldn't be using Android.
  - ilobby 12y ago
    Excellent point. So do it. iLobby.co
  - ilobby 12y ago
    It was about three $3.2 billion last year in 2013 from the federally registered lobbyists. The state level is probably equal to that. Some think the real numbers are closer to $9 billion at the federal level because PR and consulting don't have to be filed with the Senate clerk. https://www.opensecrets.org/lobby/ https://www.opensecrets.org/lobby/
- 12y ago

NamTaf 12y ago

You're forgetting that for all the Snowden leaks have revealed, the info in the press about Prism is still classified. IANAL, but I would imagine Apple could get smacked quite a bit if it started talking about its cooperation (not necessarily voluntary cooperation, that is) with NSA initiatives like Prism. I mean when the wikileaks cable dump came out, there was quite a bit of noise about how US government people should not visit the site because it would still constitute a breach of security even though it was in the public domain, and that they could lose their jobs for it. This is no different, really. The material is still classified whether it's spread all over the press or not, so discussing it with uncleared persons such as the public would (IANAL, again) I imagine be a breach of security.