Hacker News Reader

Comment by motohagiography | Hacker News Reader

Regarding the financial impact, what's the trade if they find out China is different? Shorting Apple? I don't think that would be a consequence. Nobody cares that China intercepts everything, we just don't want to live there or in a regime like it.

There was a rumor about separate HSMs for device personalization in China, and this would be verifiable by determining whether the Chinese HSMs could verify cryptograms produced by derived keys from a US device, against Apple's personalizaiton endpoints in china. I don't know the protocol off hand, but there is a short list of ways to do it. If Apple uses different root secrets in China from the rest of the world, what further evidence would you need?

View on HN

Apple has claimed that they don’t allow China to intercept communications using these keys. They’ve said on the record to the WSJ that they don’t do any combination of these things, and they left very little wiggle room in their denials (Google Apple China encryption keys WSJ). If you could show that they were compromising security for the Chinese government but not making any allowances for the FBI, and that their executives were lying about it, it would be a massive political scandal. There would almost certainly be congressional hearings, simply because any one of {Apple, China, tech executives caught lying, tech executives secretly collaborating with foreign governments} is by itself an opportunity for Congresspeople to get their face on TV and this would cover all the bases. Following this there would be huge US government pressure for Apple to (at minimum) cease collaborating with China to surveil its people, or else to offer the same capability to the US government. Potentially Apple’s entire business in China could be jeopardized if it was predicated on secret collaboration, not to mention their whole supply chain would be even more at risk. In the long run Apple might maneuver out of the situation somehow, but in the short run it would certainly affect them very badly.

> Following this there would be huge US government pressure for Apple to (at minimum) cease collaborating with China to surveil its people, or else to offer the same capability to the US government.

Congress knows this would only kneecap one of their largest companies (with no fallback option at present). There is no iPhone without China.

Apple can and does already provide surveillance of this type domestically to FBI/DHS/et al. Approximately all iMessages are readable by Apple and extension by the USG in real-time, with or without a warrant.

>Apple has claimed that they don’t allow China to intercept communications using these keys. They’ve said on the record to the WSJ that they don’t do any combination of these things, and they left very little wiggle room in their denials

There's wiggle room in what you wrote: "Apple doesn't allow China to intercept communications, China just does it on their own" for example is a way to parse that sentence.

That would be a bigger scandal. If Apple's communication protection protocols could be subverted in flight (i.e., not via endpoint compromises) without Apple's consent or active participation, that would imply that the protocols themselves were just for show.

Chinese national security law includes a gag order for such assistance requests.

Apple can say they don’t allow it, because their local partner company is the one actually doing it. And the local partner would say they don’t allow it, because Chinese law (and the Party) requires them to keep all national security assistance secret.

US executives can be compelled to testify truthfully under oath. There is no "Chinese law compels me to keep this secret" defense to perjury charges in the US. If credible evidence emerges, Apple executives will eventually be forced to admit whatever they know. The only viable strategy here is to have a broken system and plausible "not know" it's being exploited, but that's a very fragile approach (technically risky, vulnerable to whistleblowers) and it only works once.

Reply on news.ycombinator.com