Governments in the US and China are at the front of the line when it comes to knocking on Apple’s door to request user data relating to fraud/phishing, according to the company’s latest transparency report.
Like any tech company that handles user data, Apple gets different types of requests: those that are made when an account holder is in imminent danger, those from law enforcement agencies (LEA) trying to help people find their lost or stolen devices, those asking for Apple’s help when thieves rip off credit card data so they can buy Apple products or services on somebody else’s dime, and in situations where investigators think an account’s been used to do something illegal.
That last category has proved particularly controversial: the FBI has come knocking on Apple’s door in notable, headline-grabbing cases, including when the FBI was looking to unlock the iPhone of the San Bernardino terrorist and, more recently, when it was looking for help in breaking encryption on the iPhones of the killer in the recent Pensacola mass shooting.
In these instances, Apple famously said no to weakening encryption. Those requests didn’t involve subpoenas, though. The San Bernardino iPhone unlocking request involved a weird court order issued under the dusty All Writs Act of 1789, while the Pensacola unlocking request came in the form of a plain old letter sent from the FBI’s lawyer to Apple’s lawyer.
As far as worldwide government account requests go for the first half of 2019, Apple says that it got a high number from China’s mainland – a total of 15,666 requests – mostly due to financial fraud and phishing investigations. When it comes to phishing attacks, a single request can cover several devices. Apple counts and reports the number of accounts identified in each request, received from each country/region.
The US also had a high number of accounts specified in requests, mostly due to fraud and suspected unauthorised account access and phishing investigations. The government came looking for data pertaining to 15,301 accounts. Brazil also looked for data on a high number of accounts – 2,745 – but the country didn’t indicate what type of investigation its orders involved.
As far as device-based requests – those relating to customers trying to get their devices back after they get lost or stolen, as well as multi-device requests related to fraud investigations – Australia’s off the charts. Worldwide, it got 31,778 requests. Australia’s requests alone covered a whopping 121,011 devices – a huge chunk of the total 195,577 devices worldwide.
App Store takedown requests shrank quite a bit in this time period: China’s dropped by more than half. Apple noted that, starting with its transparency report for the second half of 2020 – the period between 1 July to 31 December 2020 – it will also include appeals pursuant to government requests to remove apps from its App Store when they allegedly violate legal and/or policy provisions.
How to fend off phishers
So many investigations into fraud, phishing and potential illegal account access! If you want to learn how to stop phishing – which, of course, can lead to thieves ripping off your payment card details, your App Store login and all manner of other sensitive data to get at that unauthorised access, please do have a listen:
Beratung Consulting are dedicated to Security solutions and are a trusted Sophos Partner.
