Apple dumped plan to fully lockup iCloud backups at FBI's request

[Matrix]

The government still cannot get into your iPhone, but it can access your iCloud backups

 

 

 

Bottom line: While Apple remains firm on not creating a way for law enforcement to get into an iPhone, the agency can still request access to data from the cloud and gets it most of the time. The tech giant reportedly had plans to secure iPhone backups stored on iCloud but nixed the idea after the FBI intervened.

Currently, iPhone data is encrypted on the phone and iCloud. While Apple does not have keys for physical devices, it does have them for backups in the cloud. It claims this is for customer convenience. If a user forgets their password, Apple can still recover their data for them.

 

“Our users have a key, and we have one,” Tim Cook told German outlet Spiegel in an interview in 2018. “We do this because some users lose or forget their key and then expect help from us to get their data back.”

 

"Apple was convinced. Outside of that public spat over San Bernardino, Apple gets along with the federal government."

 

The Verge noted in 2016, Apple had plans to increase iCloud security so that neither it nor law enforcement could gain access to backed up data, just as it is on the iPhone. This was at the height if its public squabble over opening San Bernardino shooter Syed Farook’s iPhone. It would have effectively closed a loophole on the agency and tied Apple’s hands to do anything about it. However, Cupertino never followed through with the idea.

 

Now, Reuters reports that it was at the FBI’s urging that the company left the loophole open. A former agent told Reuters that the agency convinced Apple not to lockout iCloud as it would severely harm its investigations.

 

 

“It’s because Apple was convinced,” said the agent. “Outside of that public spat over San Bernardino, Apple gets along with the federal government.”

 

A former employee claimed that the plan had legal ramifications that Apple did not want to face, such as not complying with a court order. Plus, it was already mixed up in a legal battle with the agency over it wanting a backdoor into phones.

 

“Legal killed it, for reasons you can imagine,” said the insider. “They decided they weren’t going to poke the bear anymore,” the source added, indicating that Apple did not want to provoke the FBI any more than it already had.

 

Coupled with the customer-convenience reasoning that Cook later mentioned, the motivation for end-to-end encryption on iCloud backups faded. Interestingly, this news comes to light just as Apple enters another conflict, with government officials claiming the company is not being cooperative.

 

"Legal killed it. They decided they weren’t going to poke the bear anymore."

 

On the contrary, Apple receives thousands of legal requests from law enforcement for access to iCloud data every year. It claims to comply with about 90 percent of the inquiries and posts them in a transparency report.

 

What seems to be at issue here is the FBI’s desire to have a backdoor into physical devices. Sometimes users do not back up their iPhones frequently enough or even at all, making iCloud data less useful in an investigation. Instead of only being able to see what suspects did last week or a month ago, law enforcement would like to see what they were doing yesterday.

 

It’s not that Apple is not supplying data to the FBI; it’s that the information is not good enough.

 

Source

[Karlston]

Reuters: Apple cut backup end-to-end encryption plans after FBI complained

Decision means Apple can still decrypt iPhone/iPad backups for law enforcement.

Enlarge / The iPhone 11, iPhone 11 Pro, and iPhone 11 Pro Max running iOS 13.

Samuel Axon

Two years ago, Apple dropped a plan that would have made it impossible for the company to decrypt iPhone and iPad backups for law enforcement, according to a Reuters report today. Reuters wrote that "six sources familiar with the matter" confirmed that Apple dropped the end-to-end encryption plan for iCloud Backup "after the FBI complained that the move would harm investigations."

 

Apple had "told the FBI that it planned to offer users end-to-end encryption when storing their phone data on iCloud" more than two years ago, Reuters wrote.

 

"Under that plan, primarily designed to thwart hackers, Apple would no longer have a key to unlock the encrypted data, meaning it would not be able to turn material over to authorities in a readable form even under court order," the report continued.

 

But the FBI objected, and Apple dropped the plan, although the exact reason for doing so isn't clear. One former Apple employee told Reuters that the company "decided they weren't going to poke the bear anymore." However, another former Apple employee "said it was possible the encryption project was dropped for other reasons, such as concern that more customers would find themselves locked out of their data more often."

 

Apple had "10 or so experts" working on the end-to-end encryption plan, "variously code-named Plesio and KeyDrop," but told them to stop work on the project once the decision was made, according to Reuters' sources.

 

The reversal "shows how much Apple has been willing to help US law enforcement and intelligence agencies, despite taking a harder line in high-profile legal disputes with the government and casting itself as a defender of its customers' information," Reuters wrote.

 

We contacted Apple about the Reuters report today and will update this article if we get a response.

Encryption vs. end-to-end encryption

Nearly all types of iCloud data are encrypted both in transit and on Apple's servers, Apple explains in this security overview. But only certain Apple services get the extra protection of end-to-end encryption, in which "your data is protected with a key derived from information unique to your device, combined with your device passcode, which only you know." When end-to-end encryption is enabled, Apple doesn't have a key to unlock the data and therefore cannot turn a decrypted version over to law enforcement. "No one else can access or read this data," Apple's website says.

 

The iCloud Keychain password manager, Wi-Fi passwords, and Siri usage information are among the data sets stored in iCloud with end-to-end encryption. Notably, Apple has not implemented end-to-end encryption for iCloud Backup, the service that lets customers back up their iPhones and iPads to Apple servers, or for iCloud Drive. The iCloud Backup and iCloud Drive data sets are encrypted at rest and in transit, but Apple has the key to unlock them and can thus give decrypted versions to law enforcement.

 

Messages is a special case. Messages itself has end-to-end encryption, but iCloud Backup "includes a copy of the key protecting your Messages." If you want full protection for Messages, you'd want to disable iCloud Backup and back your iOS devices up to iTunes on your computer instead.

 

iCloud Backup's inclusion of a copy of the Messages key "ensures you can recover your Messages if you lose access to iCloud Keychain and your trusted devices," Apple explains. "When you turn off iCloud Backup, a new key is generated on your device to protect future messages and isn't stored by Apple."

US/Apple dispute

Apple has been one of the leading proponents of encryption in the face of government pressure to install backdoors that could undermine security for all technology users.

 

The Reuters report comes amid the latest dispute over encryption between Apple and the US government, which began with the FBI asking Apple for help decrypting two iPhones believed to have belonged to Mohammed Saeed Alshamrani, a Saudi Air Force officer and suspect in the December 2019 shooting of three members of the US Navy at a base in Pensacola, Florida.

 

As we wrote last week, "an Apple spokesperson said that Apple had provided the contents of the cloud backups of those devices to investigators within hours of the shooting, and Apple executives thought the FBI was satisfied with that—until the FBI came back a week ago and asked for additional assistance."

 

President Trump blasted Apple on Twitter last week, writing that Apple "refuses to unlock phones used by killers, drug dealers and other violent criminal elements."

 

Apple countered that it gave the FBI "gigabytes of information," including "iCloud backups, account information and transactional data for multiple accounts."

 

Apple may be unable to unlock the phones since it hasn't granted the government's request for a backdoor—and continues to argue that encryption backdoors would harm security for all users.

 

"We have always maintained there is no such thing as a backdoor just for the good guys," Apple said in its statement, according to CNBC. "Backdoors can also be exploited by those who threaten our national security and the data security of our customers. Today, law enforcement has access to more data than ever before in history, so Americans do not have to choose between weakening encryption and solving investigations. We feel strongly encryption is vital to protecting our country and our users' data."

 

Source: Reuters: Apple cut backup end-to-end encryption plans after FBI complained (Ars Technica)