APPLE TO STORE iCLOUD KEYS IN CHINA, RAISING HUMAN RIGHTS FEARS
When Apple begins hosting Chinese users’ iCloud accounts in a new Chinese data centre at the end of this month to comply with new laws there, Chinese authorities will have far easier access to text messages, email and other data stored in the cloud.
That’s because of a change to how the company handles the cryptographic keys needed to unlock an iCloud account. Until now, such keys have always been stored in the United States, meaning that any government or law enforcement authority seeking access to a Chinese iCloud account needed to go through the US legal system.
Now, according to Apple, for the first time the company will store the keys for Chinese iCloud accounts in China itself. That means Chinese authorities will no longer have to use the US courts to seek information on iCloud users and can instead use their own legal system to ask Apple to hand over iCloud data for Chinese users, legal experts said.
Human rights activists say they fear the authorities could use that power to track down dissidents, citing cases from more than a decade ago in which Yahoo handed over user data that led to arrests and prison sentences for two democracy advocates. Jing Zhao, a human rights activist and Apple shareholder, said he could envisage worse human rights issues arising from Apple handing over iCloud data than occurred in the Yahoo case.
In a statement, Apple said it had to comply with recently introduced Chinese laws that require cloud services offered to Chinese citizens be operated by Chinese companies and that the data be stored in China. It said that while the company’s values don’t change in different parts of the world, it is subject to each country’s laws.
“While we advocated against iCloud being subject to these laws, we were ultimately unsuccessful,” itsaid. Apple said it decided it was better to offer iCloud under the new system because discontinuing it would lead to a bad user experience and actually lead to less data privacy and security for its Chinese customers.
As a result, Apple has established a data centre for Chinese users in a joint venture with state-owned firm Guizhou- Cloud Big Data Industry. The firm was set up and funded by the provincial government in the relatively poor southwestern Chinese province of Guizhou in 2014. The Guizhou company has close ties to the Chinese government and the Chinese Communist Party.
The Apple decision highlights a difficult reality for many US technology companies operating in China. If they don’t accept demands to partner with Chinese companies and store data in China then they risk losing access to the lucrative Chinese market, despite fears about trade secret theft and the rights of Chinese customers.
Apple says the joint venture does not mean that China has any kind of “backdoor” into user data and that Apple alone — “not its Chinese partner”— will control the encryption keys. But Chinese customers will notice some differences from the start: their iCloud accounts will now be cobranded with the name of the local partner, a first for Apple. And even though Chinese iPhones will retain the security features that can make it all but impossible for anyone, even Apple, to get access to the phone itself, that will not apply to the iCloud accounts. Any information in the iCloud account could be accessible to Chinese authorities who can present Apple with a legal order.
Apple said it will only respond to valid legal requests in China, but China’s domestic legal process is very different than that in the US, lacking anything quite like an American “warrant” reviewed by an independent court, Chinese legal experts said. Court approval isn’t required under Chinese law and police can issue and execute warrants.
“Even very early in a criminal investigation, police have broad powers to collect evidence,” said Jeremy Daum, an attorney and research fellow at Yale Law School’s Paul Tsai China Center in Beijing. “(They are) authorised by internal police procedures rather than independent court review, and the public has an obligation to cooperate.”
Guizhou- Cloud Big Data and China’s cyber and industry regulators did not immediately respond to requests for comment.
The Guizhou provincial government said it had no specific comment.