In early 2018, Apple forced their users to opt-in to migrating iCloud encryption keys and data to Chinese data centers:
https://www.reuters.com/article/us-china-apple-icloud-insigh...
Chinese government nationalized the data centers six months later, gaining access to all the encryption keys and user iCloud data at rest. Apple complied:
https://mashable.com/article/china-government-apple-icloud-d...
"Encryption for us is the same in every country in the world...We worked with a Chinese company to provide iCloud, but the keys [...] are ours...I wouldn't get caught up in 'where's the location of it,' I mean we have servers located in many different countries in the world. They're not easier to get data from being in one country versus the next...The key question is how does the encryption process work, and who owns the keys — if anyone. In most cases for us, you and the receiver [of a message] own the keys." - Tim Cook
(https://www.businessinsider.com/tim-cook-apple-encrypts-data...)
Apple is specifically stating that they have retained control over the encryption keys.
Tim Cook is describing how encryption works - he is not saying that the Chinese government doesn't have access to the data at rest with the iCloud encryption keys. Amnesty International [1] sums it up:
>“By handing over its China iCloud service to a local company without sufficient safeguards, the Chinese authorities now have potentially unfettered access to all Apple’s Chinese customers’ iCloud data. Apple knows it, yet has not warned its customers in China of the risks.”
They raised this issue three full months before the Chinese government went ahead and nationalized all of the Apple user data and encryption keys.
[1] https://www.amnesty.org/en/latest/news/2018/03/apple-privacy...
If you are targeted by the CCP, then yes, they can make a “legal” request for the data of an individual that Apple is able the decrypt (which isn’t all of it), but they aren’t able to apply mass surveillance to the iCloud data.
The encryption keys are for iCloud backups at rest, for which a copy of the keys are stored serverside. This can decrypt all iCloud data, including messages, pics, videos, documents, etc. Tim only described E2E message encryption between users, not encrypted iCloud backups.
Again, Tim isn't saying what you think he's saying. He's intentionally not answering that question or misdirecting - he's doing it all over again here: