Unfortunately as an iOS user tied to the ecosystem this puts me in a difficult situation ethically speaking. I am sponsoring this.
Perhaps I should stop buying into corporate marketing ideologies. Got burned by that before (Microsoft))
I think they would argue that, given that all phones are subject to state surveillance, iPhone users in China are no worse off than if they were using another phone. Also since iPhones are generally a lot more secure than other phones against non-state attacks, they are actually better off than they would otherwise be.
That's a tough call. I have family in China, since my wife is Chinese, and they have iPhones. Would they be better off if Apple pulled out of Chine or worse off?
Well, they chose iPhones and they are more secure so isn't it up to them? They wouldn't thank me if I took their iPhones away. On the other hand, if Apple pulled out of China on privacy grounds, it would be massive news. It would not be something the Chinese government could ignore, and might conceivably raise awareness of pervasive state surveillance in China.
But people in China are already very much aware of pervasive state surveillance. They even have a social credit system based on watching everything they do. Chinese state control of public narratives is so total, I actually doubt it would make any difference.
I mean, in the end it's the same thing as the classic "I didn't do anything wrong, I've been following orders".
In that case Apple successfully fought the FBI demand, within the law. Had the law required them to render assistance I'm sure they would have done so, otherwise they would have been requiring their employees to break the law.
Under what circumstances do you think it is acceptable for a company to require it's employees to incriminate themselves?
> Under what circumstances do you think it is acceptable for a company to require it's employees to incriminate themselves?
Human rights violations should be more than enough.
The world is not that a big place. It doesn't take a lot for this to end up on everyone's laps and then it's too late to say I told you so.
We can't outsource our responsibility as citizens of democracies to a corporation. Apple has done a heck of a lot more than most of us on HN in this fight, by standing up to unreasonable law enforcement requests for access to iPhone data, when the other phone companies rolled over. How much have you done on that front recently? A heck of a lot less than Apple, I'm willing to wager.
Let's skip the whataboutism in these threads. That solves nothing. Incidentally I do a lot more than most people do on this matter.
The FBI requesting a backdoor to terrorist iphones was the exact same: https://en.wikipedia.org/wiki/2015_San_Bernardino_attack#Pho...
Apple decided to comply with China to keep access to the market.
https://support.apple.com/en-us/HT208351
Can you link to a source showing that Apple didn't turn over control of iCloud in China to the CCP?
"Encryption for us is the same in every country in the world...We worked with a Chinese company to provide iCloud, but the keys [...] are ours...I wouldn't get caught up in 'where's the location of it,' I mean we have servers located in many different countries in the world. They're not easier to get data from being in one country versus the next...The key question is how does the encryption process work, and who owns the keys — if anyone. In most cases for us, you and the receiver [of a message] own the keys." - Tim Cook
(https://www.businessinsider.com/tim-cook-apple-encrypts-data...)
Not only has Apple given the iCloud keys to the kingdom to China, iCloud is actually run by the state in China
From a later article from the same source, Apple states: "Apple has not created nor were we requested to create any backdoors and Apple will continue to retain control over the encryption keys to iCloud data"
https://money.cnn.com/2018/02/28/technology/apple-icloud-dat...
I'm not saying it's not concerning, and China can still request a particular users data, but let's be accurate.
"You understand and agree that Apple and GCBD [emphasis added] will have access to all data that you store on this service."
https://www.apple.com/legal/internet-services/icloud/en/gcbd...
GCBD, a state-owned company, certainly gives the Chinese government the ability to see all iCloud data. It is technically true that if the Chinese government sends a data request to Apple, Apple can try to push back within the legal system, but why would they send a data request to Apple when they can get unfettered access from GCBD?
As far as who controls the keys for decrypting iCloud data at rest, I cannot believe that Chinese iCloud data would be sent encrypted to Apple's servers outside of China to be encrypted for rest with Apple-controlled keys and sent back to GCBD servers for storage and then sent to Apple's servers outside of China for decryption after verifying it is a user authorized request and back encrypted for the user when the user requests the data (and the same for all operations on the data like indexing). The keys absolutely must exist in China under GCBD's control.
Craig Federighi testified that he’s not aware of them doing it. That doesn’t preclude the possibility that it has been done by someone else in the company without his knowledge.
In early 2018, Apple forced their users to opt-in to migrating iCloud encryption keys and data to Chinese data centers:
https://www.reuters.com/article/us-china-apple-icloud-insigh...
Chinese government nationalized the data centers six months later, gaining access to all the encryption keys and user iCloud data at rest. Apple complied:
https://mashable.com/article/china-government-apple-icloud-d...
"Encryption for us is the same in every country in the world...We worked with a Chinese company to provide iCloud, but the keys [...] are ours...I wouldn't get caught up in 'where's the location of it,' I mean we have servers located in many different countries in the world. They're not easier to get data from being in one country versus the next...The key question is how does the encryption process work, and who owns the keys — if anyone. In most cases for us, you and the receiver [of a message] own the keys." - Tim Cook
(https://www.businessinsider.com/tim-cook-apple-encrypts-data...)
Apple is specifically stating that they have retained control over the encryption keys.
Tim Cook is describing how encryption works - he is not saying that the Chinese government doesn't have access to the data at rest with the iCloud encryption keys. Amnesty International [1] sums it up:
>“By handing over its China iCloud service to a local company without sufficient safeguards, the Chinese authorities now have potentially unfettered access to all Apple’s Chinese customers’ iCloud data. Apple knows it, yet has not warned its customers in China of the risks.”
They raised this issue three full months before the Chinese government went ahead and nationalized all of the Apple user data and encryption keys.
[1] https://www.amnesty.org/en/latest/news/2018/03/apple-privacy...
If you are targeted by the CCP, then yes, they can make a “legal” request for the data of an individual that Apple is able the decrypt (which isn’t all of it), but they aren’t able to apply mass surveillance to the iCloud data.
The encryption keys are for iCloud backups at rest, for which a copy of the keys are stored serverside. This can decrypt all iCloud data, including messages, pics, videos, documents, etc. Tim only described E2E message encryption between users, not encrypted iCloud backups.
Again, Tim isn't saying what you think he's saying. He's intentionally not answering that question or misdirecting - he's doing it all over again here:
Fundamentally they moved their kit into a state owned data centre.
Have they not regularly done so in the U.S. too? I thought the recent-ish drama with them refusing to unlock phones was that they were being asked to break into their own secure enclave system, taking an unreasonable amount of effort and permanently making their own product less secure?
They're a big company but they're still a company. They have to abide by the laws of whatever countries they're operating in.