Comment on iPhone and iPad approved to handle classified NATO information

• NaibofTabr@infosec.pub ⁨2⁩ ⁨weeks⁩ ago

  Sort of.

  In 2017 China passed a law requiring Chinese user data to be held within the country: nytimes.com/…/apple-china-privacy-censorship.html

  Following that, Apple paid for a local data center which is managed by a Chinese company. Functionally this means that the PRC has access to all of the data stored there, because the government exerts direct control over Chinese companies, especially anything related to data collection and storage. Most likely, the PRC is able to access Apple users’ iCloud data if it resides in the China-based data center.

  In response to a 2017 Chinese law, Apple agreed to move its Chinese customers’ data to China and onto computers owned and run by a Chinese state-owned company.

  Chinese government workers physically control and operate the data center. Apple agreed to store the digital keys that unlock its Chinese customers’ information in those data centers. And Apple abandoned the encryption technology it uses in other data centers after China wouldn’t allow it.

  Independent security experts and Apple engineers said Apple’s concessions would make it nearly impossible for the company to stop Chinese authorities from gaining access to the emails, photos, contacts, calendars and location data of Apple’s Chinese customers.

  This is not really different from what’s been happening with other countries requiring their citizens’ data to be held within their borders, and the UK has similarly forced Apple to withdraw the Advanced Data Protection for iCloud users: theverge.com/…/apple-uk-icloud-encrypted-backups-…

  […] British security services would have access to the backups of any user worldwide, not just Brits, and Apple would not be permitted to alert users that their encryption was compromised.

  source