iCloud in China has been hosted by a local licencee for a while. People who care about privacy are at least aware that the backend is no longer secure.

While we are on the topic, Windows 10 binary for Chinese government contracts are compiled by a third party company based in China so certain features could be added/removed at code level without directly giving away the source code. It may only be a matter of time before this practice permeates into retail and OEM markets.

How do I, as a US citizen, know that Apple isn't replicating my data to this Chinese datacenter?

I know you will say "you have to trust them", but therein lies the problem. There is no way for consumers to verify anything about their data.

Exactly why I simply cannot trust their supposed 'commitment to privacy'. How could you take it seriously when they are willing to play ball with this clear human rights issue? It's madness.

Short answer is we will never know for sure. There is no reason or incentive for Apple to duplicate your data and it certainly breaches an assortment of data protection laws. Nevertheless you data is always one error away from being sent all over the world. Recall the incident when Cloudflare leaked an unknown amount of information to the public, looks like they have suffered very little repercussion given the scope of the leak.

https://blog.cloudflare.com/incident-report-on-memory-leak-c...

On another note, if I get my data on the Chinese datacenter, does this mean my country's government is unable to extract this information from Apple?

If they send a notice to Apple for my data, will Apple refer them to China instead?

My brain's being a bit pedantic/dense about wording, so I want to clarify - are you saying that Windows 10 builds destined for Chinese governmental use are shipped to China in source form?

No. The source code is shipped to a system integrator based in China, vetted by both parties and under strict NDA, who then edit the code with required changes, compile and ship the binary to government users.

MS have, for a long time, allowed major customers to audit Windows source code on site but they are still forbidden from making copies. The whole setup is meant to avoid shipping source code directly.

Thanks for the insight.

I'm guessing the on-site/NDA combination is intended to prevent another Mainsoft (and all the other leaks...) from happening.

I wonder if I stand a chance of turning up a copy of Chinese-governmental Windows 10. Would be awesome.

Why does Microsoft not make those changes themselves? Does the Chinese government not want them to know what changes they want?

Well, obviously politics, burden of blame, and plausible deniability, and all that. Microsoft never made the changes themselves, they've no real idea what happened, they just sat in a corner of the room and glanced at the devs' screens once in a while to make sure they didn't look like they were stealing anything.