Rotten Apple

Apple under fire for moving iCloud data to China: Apple's latest move has privacy advocates and human rights groups worried.

by Sherisse Pham

The U.S. company is moving iCloud accounts registered in mainland China to state-run Chinese servers on Wednesday along with the digital keys needed to unlock them.
"The changes being made to iCloud are the latest indication that China's repressive legal environment is making it difficult for Apple to uphold its commitments to user privacy and security," Amnesty International warned in a statement Tuesday.
The criticism highlights the tradeoffs major international companies are making in order to do business in China, which is a huge market and vital manufacturing base for Apple.
In the past, if Chinese authorities wanted to access Apple's user data, they had to go through an international legal process and comply with U.S. laws on user rights, according to Ronald Deibert, director of the University of Toronto's Citizen Lab, which studies the intersection of digital policy and human rights.
"They will no longer have to do so if iCloud and cryptographic keys are located in China's jurisdiction," he told CNNMoney.
The company taking over Apple's Chinese iCloud operations is Guizhou-Cloud Big Data (GCBD), which is owned by the government of Guizhou province. 

GCBD did not respond to requests for comment.
The change only affects iCloud accounts that are registered in mainland China.
Apple made the move to comply with China's latest regulations on cloud services. 

A controversial cybersecurity law, which went into effect last June, requires companies to keep all data in the country. 

Beijing has said the measures are necessary to help prevent crime and terrorism, and protect Chinese citizens' privacy.
The problem with Chinese cybersecurity laws, Deibert said, is that they also require companies operating in China "to turn over user data to state authorities on demand -- Apple now included."
Other big U.S. tech companies have had to take similar steps -- Amazon and Microsoft also struck partnerships with Chinese companies to operate their cloud services in the country.
"Our choice was to offer iCloud under the new laws or discontinue offering the service," an Apple spokesman told CNN. 

The company decided to keep iCloud in China, because cutting it off "would result in a bad user experience and less data security and privacy for our Chinese customers," he said.
Apple users typically use iCloud to store data such as music, photos and contacts.
That information can be extremely sensitive. 

Earlier this month, Reporters Without Borders urged China-based journalists to change the country associated with their iCloud accounts -- which is an option for non-Chinese citizens, according to Apple -- or to close them down entirely.
Human rights groups also highlighted the difficult ethical positions Apple could find itself in under the new iCloud arrangement in China.
The company has fought for privacy rights in the Unites States. 

It publicly opposed a judge's order to break into the iPhone of one of the terrorists who carried out the deadly attack in San Bernardino in December 2016, calling the directive "an overreach by the US government."
At the time, CEO Tim Cook pretentiously said complying with the order would have required Apple to build "a backdoor to the iPhone ... something we consider too dangerous to create."
Human Rights Watch questioned whether the company would take similar steps to try to protect users' iCloud information in China, where similar privacy rights don't exist.
"Will Apple challenge laws adopted by the Chinese government that give authorities vast access to that data, especially with respect to encrypted keys that authorities will likely demand?" asked Sophie Richardson, China director for Human Rights Watch.

Apple declined to answer that question directly,.
"Apple has not created nor were we requested to create any backdoors and Apple will continue to retain control over the encryption keys to iCloud data," the Apple spokesman said.
Rights groups and privacy advocates are not convinced.
"China is an authoritarian country with a long track record of problematic human rights abuses, and extensive censorship and surveillance practices," Deibert said.
Apple users in China should take "extra and possibly inconvenient precautions not to store sensitive data on Apple's iCloud," he advised.
Most of those users have already accepted the new status quo, according to Apple. 

So far, more than 99.9% of iCloud users in China have chosen to continue using the service, the Apple spokesman said.

Tech Quisling

Apple’s iCloud Data Storage in China Includes Cryptographic Keys – Decision Raises Security Concerns
By Rafia Shaikh

Apple will begin hosting iCloud data of its Chinese users in a new data center in China. 

Complying with the tougher Chinese laws, the local authorities will start having faster access to iPhone users’ data stored in the cloud. 

The company had first announced this move last summer after the new cybersecurity laws were passed in China requiring all the foreign companies to use locally managed businesses to store data.
This data, that is currently stored in the United States, will now be stored locally in China and includes, among other things, iCloud cryptographic keys needed to unlock an account. 

This essentially means that China will no longer need to reach out to the US government or deal with US legal system to seek information on a Chinese Apple user. 

While this is becoming an increasingly common practice with the US itself pushing for a similar strategy, the approach does raise user privacy and security concerns. 

Reuters reports today that it’s the first time for Apple to store keys outside of the United States.
That means Chinese authorities will no longer have to use the U.S. courts to seek information on iCloud users and can instead use their own legal system to ask Apple to hand over iCloud data for Chinese users, legal experts said.
For a perspective, Apple reportedly refused all requests it received from the Chinese authorities for information on over 176 users between 2013 and mid-2017. 

Considering China’s tightening control over local internet access, human rights advocates warn that this move will make it impossible for dissidents and journalists in China to freely communicate, as it will become easier for the authorities to track them down. 

They are also pointing to a similar move taken by Yahoo several years ago, when this data access was used to arrest dissidents and human rights activists.
“Jing Zhao, a human rights activist and Apple shareholder, said he could envisage worse human rights issues arising from Apple handing over iCloud data than occurred in the Yahoo case,” Reuters report added.
In its statement Apple said it has to comply with the local laws as it does in the United States, as well. 

The move does raise questions over Apple’s previous strategy of keeping user security at the center of its business – something that no longer seems to be the case.
“While we advocated against iCloud being subject to these laws, we were ultimately unsuccessful,” Apple said in its statement. 

The company said offering this new system was a better choice than discontinuing it which would have led to bad user experience.
The company continued to say that the latest move affects only the data stored in cloud that will now be easily accessible to Chinese authorities who will just need to push Apple with a local legal warrant.
While Apple led the industry with user-focused decisions for years, it continues to make moves that no longer align with the company’s previous focus on user privacy. 

The company recently also removed VPN apps from its Chinese App Store raising questions from the United Nations. 

Tim Cook had said at the time that the company was “just following the law.”
Privacy advocates warn that Apple’s decision to comply with the Chinese demands will only hurt Apple and other tech companies in the long run, since more governments will follow to make similar demands. 

The company’s position, however, aligns with what Bill Gates had said earlier this month – follow whatever governments legally ask you or be ready for strict government regulation.