Myself, I think they did fairly well, certainly the best of any tech company out there today.
Ok. "We're enabling custom encryption key management. You may now generate and use your own encryption keys. In addition to ensuring the device data is encrypted, nothing in your iCloud account can be recovered if you lose your key because it is all pre-encrypted before being sent to iCloud. Again, if you lose your key, there is no recovery possible. We'll also be opening up a new bug-bounty program specifically for identifying weaknesses and exploits in our baseband, firmware, and OS that could result in the leaking of your encryption keys and personal data. Here at Apple, we take your privacy serious."
Until then I assume it is unsecure.
It's not unreasonable that American citizens might feel more empowered voting with their dollars than with ballot papers.
With the companies in question, it's not hard to vote with your feet and complain. With the government, it's very difficult.
When someone voted in by a single state can influence the entire country like that, it makes everyone feel powerless. I'd rather give my money to a company that has my interests in mind throughout the years in exchange for products and services than dump thousands of dollars into someone's campaign like a drunken bet at a Las Vegas casino every couple of years.
(The same is largely true in the EU, even though it's possibly more pronounced the US.)
https://www.apple.com/apples-commitment-to-customer-privacy/
In addition the new section launched today includes a page on government information requests, including "National Security Orders from the U.S. government." One sentence summary: they provide data to the government when required to by law.
PRISM itself is a program that is structured as a request/response, and the requests are approved by the FISA court, so it would fit into Apple's language in that section.
The initial report of PRISM implied that the NSA and FBI had direct, unfettered access to providers' "central servers", but that has been since walked back a bit. The points of concern with PRISM are 1) poor oversight from the FISA court, 2) overly broad request criteria resulting in huge datasets collected, and 3) the lack of public oversight due to gag orders.
Really? I haven't been able to follow every report, as the Snowden leaks generated a lot of content over the past year. Can you give a source to where PRISM's central server access has been "walked back a bit"?
http://en.wikipedia.org/wiki/PRISM_%28surveillance_program%2...
The press report that most directly addresses the issue is probably this one:
http://www.cnet.com/news/no-evidence-of-nsas-direct-access-t...
Incidentally the author of that story is doing a startup now, visits HN, and actually has posted in this thread! Username is "declan."
Essentially, it seems there are a number of NSA programs that we can now distinguish from one another.
PRISM uses the FBI and FISA court orders to directly request records from hosted application providers like Google, Yahoo, Apple, etc.
But there are also other programs that claim to be authorized under the FISA law that target network infrastructure companies like Verizon and AT&T, apparently sucking up and storing huge amounts of raw traffic directly from network infrastructure. This would be the famous "secret room" at AT&T network building in California. These could suck up Apple traffic (or anyone else) but Apple would not be aware because it's at the network layer.
Then there is MUSCULAR, in which the NSA helped the British GCHQ hack into the internal networks of Google (without Google's knowledge) to suck data out of the unencrypted connections between Google servers.
Yes, that's true. But if you run an email service that's based in Cupertino, what do you do when served with a lawful search warrant or wiretap order? Say "no," and be found in contempt of court and have all your servers carted away by some men in black so they can find the file they're looking for?
There are a few ways around this. One is not to permanently store warrant-worthy user data (Snapchat, Wickr, etc.). Another is end-to-end encryption (original version of Hushmail), though key distribution and UX become problems. A third is to move your servers to Switzerland, though then you get served with process from the Swiss authorities instead of FBIDHSDEAetc.
Apple has taken none of these steps. Assume our hypothetical Cupertino-based email service has not either. What do you do when the Feds show up with a lawful order?
I don't expect them to say no. That's why I don't expect them to imply that they would or suggest that they never have.
And, if you keep your headquarters in Cupertino, quite possibly from US authorities as well (see the currently in-progress Microsoft case about access to servers in Ireland).
It's been "fun" to read Jewel vs. NSA proceedings, press statements, and officials' statements about these issues because of the extent to which they play word games to technically not lie according to specific (re)definition of words.
Even if you are root it's no guarantee, thank you rootkits :/
As with all things security, sometimes it comes down to trust and legal protections.
You could still NSL a backdoor, but if the service is open source at least there's a chance of the code being audited.
Without a trust the only thing that comes close is an in person P2P pairing ceremony.
Key management might work in an enterprise setting with a central authority, but making sure your friend's public key isn't swapped with the government's is pretty hard if you don't trust the cloud provider, telecom, or intermediate infrastructure.
I mean when the wikileaks cable dump came out, there was quite a bit of noise about how US government people should not visit the site because it would still constitute a breach of security even though it was in the public domain, and that they could lose their jobs for it. This is no different, really. The material is still classified whether it's spread all over the press or not, so discussing it with uncleared persons such as the public would (IANAL, again) I imagine be a breach of security.
I consider that a back door.
>We have also never allowed any government access to our servers. And we never will
Makes it clear what he means in the first statement.
I've known Apple to engage in hyperbole to a significant degree, but never -- in nearly 40 years-- to lie publicly.
They haven't denied providing information under warrant. Basically, every US company is going to do that.
But that's on a case by case basis, not wholesale.
I'm very interested to see how the device vs. account data-request ratio maintains/changes with the release and adoption of iOS 8.
I think that would be reasonable information to share, because it'd educate both law enforcement and the general public about what data is available from their devices.
Plus it'd settle the issue of word games- or at least bring it closer to being settled in my eyes. We can't get a good idea of what is going on with these 10k foot marketing pronouncements.
Page 4 onwards provides a list of information they provide to law enforcement agencies. Probably prudent if you're an apple customer to simply assume all of this information is as good as public.
...
For all devices running iOS 8.0 and later versions, Apple will no longer be performing iOS data extractions as the data sought will be encrypted and Apple will not possess the encryption key.
Interesting. What changed in iOS 8, I wonder?
Seemingly, they also have some sort of canary in place in case they get secret requests under the patriot act: http://boingboing.net/2013/11/05/apple-hides-a-patriot-act-b...
It was removed for the latter half of 2013, and this just-released first half of 2014 report.
Take that as you will.
By omitting the line you are, for most intents and purposes, saying that you received a request. Now, saying you received a request and saying specifically what request you received are different, but I imagine the gag order doesn't make that differentiation.
Gag order is not that you can't say a specific thing, it's that you can't communicate a specific piece of information. The canary is communicating something.
A court order can ask you to lie, so the "I can't lie to my customers" defence probably won't work.
* "In addition, Apple has never worked with any government agency from any country to create a “back door” in any of our products or services."
If Apple provides an interface to request user-data to law enforcement / NSA, that's not a back door in the product or the service.
* "We have also never allowed any government access to our servers. And we never will."
If they provide user-data after being served with a warrant (possibly through email or to their legal department), their servers were never accessed, yet the data was provided.
It's always interesting to read what is and isn't said. Word games, I swear.