Apple - The Guardian of Your Privacy

Recent news on the FBI's $1.3 million plus hack into Apple's flagship product got me wondering how many requests Apple gets from governments around the world for its customers' content.  This is a subject of some concern given the revelations of Edward Snowden back in 2013 and the ongoing inability of the world's government security apparatus to put a dent in terrorist activities.   In its latest transparency report for the period from January 1 to June 30, 2015, Apple reports the following government requests for information on its customer base:

1.) Device requests: The majority of these relate to information about stolen or lost Apple devices and may include customer contact information that was provided to Apple when the device was registered by the owner.  Here is a table showing how many law enforcement device requests Apple received in the first half of 2015 by nation:

The largest number of requests come from Germany at 9659 followed by the United States at 3824, however, Australia is not far behind at 2986.  This is surprising given that Germany has about 25 percent of the population of the United States and Australia has roughly 7 percent of the population of the United States.  It is also interesting to note that Apple complies with only 53 percent of the law enforcement requests that are sourced in Germany compared to 81 percent to those sourced in the United States, the highest level among the nations with a high request total.

2.) Account requests: These requests usually involve information about an account holder's iCloud or  iTunes account, for example, a name and address.  In some cases, Apple is asked to provide the actual content of a customer's iCloud account including emails, documents, photos, contacts and iOS backups.  Obviously, these requests are far more invasive and Apple may provide account access when the request is a search warrant.  Here is a table showing how many account requests Apple received in the first half of 2015 by nation:

The United States alone had 971 law enforcement account requests in the first half of 2015 compared to 696 for the remainder of the world.  Again, Apple provided account information for 81 percent of the requests in the United States, by far the highest level among major requesting nations.  Of the 2727 American accounts that were specified in the requests, Apple released data for 1407 accounts or 51.6 percent of the total and released no data for only 181 accounts.  Apple also objected to only 116 account requests or 4.3 percent of the total for the United States.  

3.) Emergency requests:  These requests are made by governments in cases where Apple believes that an "emergency involving imminent danger of death or serious physical injury to any person requires such a disclosure without delay".  Here is a table showing the number of emergency requests received during the first half of 2015 by nation:

Once again, the United States is in first place with 107 emergency requests followed by the United Kingdom with 98 and Canada with 14.

4.) National Security requests: These requests include all FISA and National Security Letters.  In the first half of 2015, Apple received between 750 and 999 national security orders that affected between 250 and 499 accounts.  By law, Apple is not allowed to be more specific about the exact number of national security requests; the bands of 250 requests are the narrowest range allowed by the federal government.

It is interesting to note that, by a wide margin, Apple is asked to release information by American authorities far more often than other nations, including China which is not exactly known for its shining human rights record.  The requests for the private content of Apple's customers should be of great concern to Apple users around the world; with law enforcement around the world finding itself unable to preempt significant terrorist acts, one has to wonder how important this personal information has been in the fight against terrorism and violent non-terrorist attacks.

How Apple Handles Your Privacy

Updated February 2016

In mid-2015 the Electronic Frontier Foundation (EFF) released its annual assessment of major technology companies and how they protect your privacy, information that is particularly pertinent given the recent news about Apple and the San Bernardino shooters.  The report, entitled "Who Has Your Back?" looks at the privacy practices of various online service providers and how they handle government requests to access user data.  The report examines the following five criteria:

1.) Industry-Accepted Best Practices: this measures companies on whether a company requires the government to obtain a warrant from a judge before handing over your online communications content, whether the company publishes a useful transparency report regarding how often the government sought user data and how often the company complied and whether the company publishes law enforcement guides explaining how they respond to data demands from the government.

2.) Tell users about government data requests: to earn a passing grade, internet companies must promise to tell users when the U.S. government seeks their data unless telling them is prohibited by law.  This gives users prior notice so that they have a chance to challenge the request and defend themselves in court.

3.) Publicly disclose the company's data retention policies: to earn a passing grade, companies must disclose how long they maintain their data about their users, particularly data that is not accessible to the user including logs of users' IP addresses and deleted content.

4.) Tell users about government removal requests: Disclose the number of times governments seek the removal of user content or accounts and how often the company complies.

5.) Pro-user public policies opposing backdoors: EFF is asking companies to take a public position against the compelled inclusion of deliberate security weaknesses or other government-compelled back doors.

Of the 24 companies in the report, only 9 received a perfect score.  These include Adobe, Apple, CREDO, Dropbox, Sonic, Wickr, Wikimedia, Wordpress and Yahoo.  Two of the poorest performers are major American telecoms; AT&T which received a passing grade in only one facet (industry-accepted best practices) and Verizon which received a passing grade in only two facets (industry accepted best practices and disclosure of the number of times that governments sought content removal).  

Let's put this into context by focus on Apple.  Apple has appeared in EFF's annual report for five years running and it has adopted every best practice that EFF has defined as part of protecting consumers' privacy.  In its latest transparency report that covers the period from July 1 to December 31, 2014, Apple reveals the following device requests:

The country with the most data requests was Germany with 7,478 law enforcement device requests covering 30,402 devices (i.e. iPhones, iPads, iPods and Macs) and that the country with the most total device requests was Poland where 30 law enforcement device requests covered a whopping 534,337 devices.  In the case of Germany, some user data was provided to the government 57 percent of the time and in the case of Poland, some user data was provided to the government 60 percent of the time.  Note that in the United States there were a total of 4,533 law enforcement device requests covering a total of 17,833 devices.  Some user data was provided to the government for 3,592 or 79 percent of the requests. 

Here is a table showing the number of times that law enforcement requested account information from Apple between July and December 2014:

User account content that Apple can release includes iCloud emails, contacts, calendar information or Photo Stream content.  In most cases, Apple will release only subscriber or transactional information not user content.  By a very wide margin, the most law enforcement requests for account information took place in the United States with 788 requests covering 5,267 accounts.  In 4,662 cases or 80 percent of total requests, Apple released some data to law enforcement.  In only 155 cases was no data disclosed and in 75 cases or 9.5 percent of the total requests, Apple objected to the law enforcement request for information.  Some user content as defined above was released in 188 cases or 23.9 percent of total law enforcement requests.

On the upside, for those of us that would rather not have our personal data follow us for an infinite length of time, Apple states that...

"Apple makes it easy for you to keep your personal information accurate, complete, and up to date. We will retain your personal information for the period necessary to fulfill the purposes outlined in this Privacy Policy unless a longer retention period is required or permitted by law."

Furthermore, according to a message from Tim Cook:

"Finally, I want to be absolutely clear that we have never worked with any government agency from any country to create a backdoor in any of our products or services. We have also never allowed access to our servers. And we never will."

As far as providing content such as mail logs, email content and subscriber information to law enforcement, Apple states that the following information is available from iCloud:

"i. Subscriber Information

When a customer sets up an iCloud account, basic subscriber information such as name, physical address, email address, and telephone number may be provided to Apple. Additionally, information regarding iCloud feature connections may also be available. iCloud subscriber information and connection logs with IP addresses can be obtained with a subpoena or greater legal process. Connection logs are retained up to 30 days.

ii. Mail Logs

Mail logs include records of incoming and outgoing communications such as time, date, sender email addresses, and recipient email addresses. Mail logs may be obtained with a court order under 18 U.S.C. § 2703(d) or a court order with an equivalent legal standard or a search warrant. iCloud mail logs are retained up to 60 days.

iii. Email Content

iCloud only stores the email a subscriber has elected to maintain in the account while the subscriber’s account remains active. Apple does not retain deleted content once it is cleared from Apple’s servers. Apple is unable to provide deleted content. Available email content may be provided in response to a search warrant issued upon a showing of probable cause.

iv. Other iCloud Content. Photo Stream, Docs, Contacts, Calendars, Bookmarks, iOS Device Backups

iCloud only stores content for the services that the subscriber has elected to maintain in the account while the subscriber’s account remains active. Apple does not retain deleted content once it is cleared from Apple’s servers. iCloud content may include stored photos, documents, contacts, calendars, bookmarks and iOS device backups. iOS device backups may include photos and videos in the users’ camera roll, device settings, app data, iMessage, SMS, and MMS messages and voicemail. iCloud content may be provided in response to a search warrant issued upon a showing of probable cause.” (my bold) 

In closing, here's what Apple says about notifying users when their personal information is being sought by law enforcement:

“Apple will notify its customers when their personal information is being sought in response to legal process except where providing notice is prohibited by the legal process itself, by a court order Apple receives (e.g., an order under 18 U.S.C. §2705(b)), or by applicable law or where Apple, in its sole discretion, believes that providing notice could create a risk of injury or death to an identifiable individual or group of individuals, in situations where the case relates to child endangerment, or where notice is not applicable to the underlying facts of the case. “

It is interesting to note that Apple gets the highest grade from the Electronic Frontier Foundation when it comes to protecting our privacy, yet, it still provides both content and user information to law enforcement for a significant percentage of law enforcement requests.  It makes one ponder what information is being provided to the government by the fifteen companies that didn't receive a perfect score on the EFF's annual assessment of the state of our privacy on the internet.

Has Apple's iPad Peaked?

With the announcement of the sixth iteration of the iPad (if we exclude the iPad mini as a separate product - it's now entering its third iteration), I wanted to take a look back at the history of iPad sales and how they look on a quarter-over-quarter growth basis.  First, a disclaimer.  I am an iPad owner but probably not the type that Apple really likes.  I am still using my three and a half year old iPad 2 and despite a decrease in operating speed for some apps with the latest version of iOS, it still suits me just fine.  Until I drop it and spider the screen, I'm unlikely to upgrade.

For your information, here are the release dates of each version of the iPad:

iPad 1 - April 3, 2010

iPad 2 - March 2, 2011

iPad 3 - March 7, 2012

iPad 4 - October 23, 2012 - introduced iPad Mini

iPad 5 (aka iPad Air) - October 22, 2013
iPad 6 (aka iPad Air 2) - October 16, 2014

Here is a graph that shows the quarter-by-quarter sales for the iPad since its introduction in the second quarter of 2010:

Sales volume is linked closely to the release dates of the new models with the biggest bump coming between the fourth quarter of 2013 and the first quarter of 2014 when sales jumped from 14.1 million units to 26 million units for the iPad Air.  This was the biggest quarter-over-quarter increase in iPad history followed by the jump from the fourth quarter of 2012 and the first quarter of 2013 when sales jumped from 14 million units to 22.9 million units when the iPad 4 and iPad mini were introduced.  What is interesting to note is that iPad sales in the third quarter of 2014 were the lowest sales level since the second quarter of 2012, coming in at 13.276 million units, a drop of almost 50 percent from the peak two quarters earlier.

Here is a graph showing iPad sales growth on a quarter-over-quarter basis:

The last two quarters have seen the largest overall decline with sales dropping by 12.724 million units or 48.9 percent from the first quarter of 2014 as I noted above.  The percentage drop from the first quarter to the second quarter of 2014 is the highest quarter-over-quarter drop, coming in slightly higher than the 36 percent drop between the first and second quarters of 2011, however, that drop could be attributed to consumers waiting on the announcement of the iPad 2 that was made in March 2011.  In the case of the 37.1 percent drop between the first and second quarters of 2014, consumers were obviously not expecting the launch of an updated iPad since it was announced in the fourth quarter of 2013.

My suspicion is that there will be a bump in sales for the iPad 6 (iPad Air 2) in the first quarter of 2015, however, it will be interesting to see if Apple's own larger screen iPhone 6 cannibalizes sales of its larger screened portable products.  Unless Apple comes up with some great iPad innovation in the near future, competition from outside companies and its own product line could make iPad sales a much smaller fraction of its overall revenue stream than their current 15  to 20 percent level.  

Apple Inc. - The Lobbyist

Updated July 2015

While Apple's product line garners all of the media's attention, the company is a participant in what is a common pastime in Washington.  Here is the data from Open Secrets showing what federal issues are important to Apple and how much they are willing to spend on what is important to the corporation.

Let's open with a bar graph showing how much Apple has spent on lobbying each year since 1998:  

In its most active year in 2014, Apple spent $4.41million on lobbying, more than it spent in the entire years of 2011 and 2012 combined.

Here is a chart showing which computer/internet companies have lobbied Washington in 2014, how much they have spent and how Apple fits into the group:

Compared to the $16.8 million spent by Google and the $9.34 million spent by Facebook, Apple's $4.41 million expenditure on lobbying is somewhat less insignificant and leaves them in 9th place overall among their peers in the computer/internet grouping.

Here is a list of the government agencies lobbied by Apple in 2014:

Here is a list of the main issues that concerned Apple in 2014

  

Like many American corporations, paying taxes was of the greatest concern to Apple.

Here is a list of the specific Bills from the 113th Congress that were of particular interest to Apple in 2014:

Apple spends a great deal of its time lobbying Washington on patent protection and defending trade secrets.

In 2014, Apple used a total of 31 lobbyists as shown on this listing:

  

A total of 28 out of 36 or 77.8 percent of these lobbyists are considered "revolvers"; revolvers are lobbyists who worked inside the federal government at some point and are considered to have more influence than non-revolvers.

While most of us tend to think of Apple as a purveyor of consumer products, there is a side to Apple that is willing to throw a bit of its considerable financial reserves to get its way in Washington.  While Apple only uses a tiny fraction of its considerable financial might to lobby Washington, particularly when compared to its tech sector peers, it is interesting to get an inside look at the issues of importance to one of America's most influential corporations.