For years, Apple has implemented strong encryption in the iPhone and most of its other products, resisting requests from Western governments to build backdoors into its encrypted software. Because, for years, we saw politicians in the US, UK, and other regions demand iPhone backdoors that law enforcement agencies can use when dealing with criminals hiding behind encrypted products and services.
Apple has always refused these requests, advocating for strong security and privacy in its products. The backdoor that some politicians may want is something of a unicorn. They want strong security in software products like iOS but also a way to access the contents of an encrypted iPhone for suspects that law enforcement is investigating.
I’ve always sided with Apple here. Placing a backdoor in any product would invite even more scrutiny from the hacking community. First, you wouldn’t be able to keep it a secret. Second, if there’s a locked door to something, someone can always find the keys.
Fast-forward to early October, and a stunning The Wall Street Journal report shows exactly what happens with backdoors in secure systems. A team of hackers associated with the Chinese government reportedly obtained access to critical infrastructure belonging to AT&T, Lumen, and Verizon that US law enforcement uses for wiretapping purposes.
In other words, China found law enforcement’s backdoor in these systems and used it for months to spy on internet traffic and even extract data.
The Journal’s report details the massive scope of the attack, and it’s a big accolade for China’s hacking abilities. Here are some quotes from the report:
For months or longer, the hackers might have held access to network infrastructure used to cooperate with lawful US requests for communications data, according to people familiar with the matter, which amounts to a major national security risk.
The widespread compromise is considered a potentially catastrophic security breach and was carried out by a sophisticated Chinese hacking group dubbed Salt Typhoon.
A person familiar with the attack said the US government considered the intrusions to be historically significant and worrisome.
This is an incredible feat.
The hackers were finally discovered in recent weeks. They had engaged in “a vast collection of internet traffic from internet service providers that count businesses large and small, and millions of Americans, as their customers.” It’s unclear how much data was stolen or how many Americans are at risk.
What seems clear is that the Chinese hackers breached the surveillance systems that carriers like AT&T and Verizon have in place to comply with court orders related to criminal and national security investigations. It’s essentially a backdoor that only certain people have access to. These would be so-called “good guys” who work in the interest of regular users.
The involved parties have yet to comment on the alleged Salt Typhoon campaign, which is under investigation. As expected, China has already denied involvement in the attack.
Back to the iPhone encryption matter, I’d expect the same thing to happen if Apple were to deploy backdoors in its software. This tool would not remain a secret.
As soon as law enforcement uses it to obtain information from an encrypted iPhone or iMessage chat, the world will know a backdoor exists. Hackers of all trades will be on the hunt for it, including the nation-state kind that breached the wiretapping infrastructure.
Let’s put it another way. Say someone steals my iPhone and then attempts to get into it. The device is encrypted with my password and Face ID. The only way to get into it is by guessing that password. As long as that doesn’t happen, my data continues to be protected, and I have time to wipe it remotely.
The downside is that criminals will use encrypted products and apps to hide from law enforcement agencies. But I’d rather have all my data secured at all times by strong encryption, not just on my iPhone but on all my internet products.
Also, think of it this way: The Chinese hack probably impacted legitimate people whose communications would otherwise not have been inspected by law enforcement. Again, I’m sure criminals would use any encrypted tool at their disposal to reduce their footprint when it comes to wiretap-related data collection.
The Journal’s full report, available at this link, is worth a read.
