In light of the recent reporting in regards to the NSA and governments across the world and their connection to the data that technology companies hold on their customers, Apple has published a lengthy document detailing its customer privacy policies.
Additionally, the company has published charts that detail how many customer data requests it has received Between the beginning of January and end of June this year from governments.
Breakdown of important details:
Apple discusses its privacy practices and how data for its apps are handled:
Apple discusses its work with the government on these privacy issues:
Perhaps most important, our business does not depend on collecting personal data. We have no interest in amassing personal information about our customers. We protect personal conversations by providing end-to-end encryption over iMessage and FaceTime. We do not store location data, Maps searches, or Siri requests in any identifiable form.
Apple discusses what kind of requests it receives from law-enforcement agencies around the world:
We believe that dialogue and advocacy are the most productive way to bring about a change in these policies, rather than filing a lawsuit against the U.S. government. Concurrent with the release of this report, we have filed an Amicus brief at the Foreign Intelligence Surveillance Court (FISA Court) in support ofa group of cases requesting greater transparency. Later this year, we will file a second Amicus brief at the Ninth Circuit in support of a case seeking greater transparency with respect to National Security Letters. We feel strongly that the government should lift the gag order and permit companies to disclose complete and accurate numbers regarding FISA requests and National Security Letters. We will continue to aggressively pursue our ability to be more transparent.
How Apple is logging these requests:
Unlike many other companies dealing with requests for customer data from government agencies, Apple’s main business is not about collecting information. As a result, the vast majority of the requests we receive from law enforcement seek information about lost or stolen devices, and are logged as device requests. These types of requests frequently arise when our customers ask the police to assist them with a lost or stolen iPhone, or when law enforcement has recovered a shipment of stolen devices.
Only a small fraction of the requests that Apple receives seek personal information related to an iTunes, iCloud, or Game Center account. Account-based requests generally involve account holders’ personal data and their use of an online service in which they have an expectation of privacy, such as government requests for customer identifying information, email, stored photographs, or other user content stored online. Apple logs these as account requests.
We believe it is important to differentiate these categories and report them individually. Device requests and account requests involve very different types of data. Many of the device requests we receive are initiated by our own customers working together with law enforcement. Device requests never include national security–related requests.
This chart below details requests for information stored on devices, country-by-country. Apple discloses in which case “some data” was provided.
Table 1 shows account requests. The U.S. government has given us permission to share only a limited amount of information about these orders, with the requirement that we combine national security orders with account-based law enforcement requests and report only a consolidated range in increments of 1000.
The most common account requests involve robberies and other crimes or requests from law enforcement officers searching for missing persons or children, finding a kidnapping victim, or hoping to prevent a suicide. Responding to an account request usually involves providing information about an account holder’s iTunes or iCloud account, such as a name and an address. In very rare cases, we are asked to provide stored photos or email. We consider these requests very carefully and only provide account content in extremely limited circumstances.
Table 2 shows device requests. Even though device requests have not been the focus of public debate, we are disclosing them to make our report as comprehensive as possible. These may include requests for the customer contact information provided to register a device with Apple or the date the device first used Apple services. We count devices based on the individual serial numbers related to an investigation.
As you can see, the United States, Singapore, and Germany lead in device-information requests. Apple ends its letter by sharing some additional details about its process and government interaction:
The number of affected accounts and devices is often larger than the number of requests because law enforcement may seek information related to multiple accounts or devices. For example, some device requests related to the theft of a shipment may involve hundreds of serial numbers.
In cases where no data was disclosed, Apple may have objected to a government request for legal reasons or searched our records and discovered that we have no relevant information. This category includes multiple scenarios in which no data was disclosed.
Apple has never received an order under Section 215 of the USA Patriot Act. We would expect to challenge such an order if served on us.
