Tim Cook’s Company-Wide Email on Hkmap.live Doesn’t Add Up

The reasons China's government has decried the app are bogus, but those false reports and allegations do not originate with Apple.

However, Apple appears to be accepting those reasons at face value and probably because Apple is kowtowing.

Regarding whether iMessage is free from backdoors, Apple has given no reason for anyone to believe they are outright lying about the technical features of their software and hardware or their position regarding privacy.

In other words, Apple appears to be caving into pressure from the Chinese government and Apple are openly admitting this surrender.

However, Apple has not to date lied about what they are doing and we do not yet have a reason to doubt their representations about the security of their encryption.

No company should be expected to back or foment a revolution somewhere, from my perspective they're looking out for their own beet interest and the best interest of their customers.

At least in China, you can probably assume iMessage is back-doored given that iCloud content in mainland China is operated by a Chinese internet company. Apple quietly posted this last week on their support page:

"iCloud services in China mainland are now operated by Chinese internet services company Guizhou on the Cloud Big Data Industrial Development Co., Ltd., (GCBD). This allows us to continue to improve iCloud services in China mainland and comply with Chinese regulations."

It goes on to say:

"iCloud services and all the data you store with iCloud, including photos, videos, documents, and backups, will be subject to the new terms and conditions of iCloud operated by GCBD."

Source: https://support.apple.com/en-us/HT208351

EDIT: After some research, it looks like the iCloud handover actually happened last year (https://www.theregister.co.uk/2018/01/11/icloud_china_goes_t...).

I was thinking about the complexity of the world the other day, and how so many people hold diametrically opposed beliefs, but often based on solid reasoning and genuine facts. How could this be?

If you think about it, the modern world is so complex, with so many facts (some of which are actual facts, some of which are popular opinions now considered to be fact), with all of the inter-connected, Nth order cause and effect going on, how is a person who wants to be as objective as possible supposed to actually come up with a reasonable model of what's going on, even if they're willing to put in the work? People skilled in communications and the psychology of persuasion can pick and choose a subset of "facts" and put together plausible and completely contradictory descriptions of the very same story, and done correctly it's very difficult even for the vigilant to know you're being duped. So what's a person to do?

What I came up with is the idea that yes, one should indeed take "facts" into consideration, including some sort of notion of trustworthiness for each fact, but what's missing is the value of lies in coming up with one's model of reality. So, when trying to figure out what the real deal is on any given situation, don't first look for the facts, but rather the obvious lies - if you can find obvious lies or misrepresentations of reality coming from powerful (politicians or corporate leaders) or influential people (the media), this is probably a good trail to follow to lead you toward the most important parts of the truth. Of course, there's lots of complexity involved here as well, you have to consider the nature of the bias from the messenger, compare versions of the lie across different outlets, etc etc etc, but in many cases I suspect this is a highly productive approach for maximizing the correctness of one's models.

So in this case, as the article points out, "However, over the past several days we received credible information....that the app was being used maliciously to target individual officers for violence". Obviously a lie, although in this case, considering Tim Cook's no dummy I expect he knew everyone would know he's lying, so I wouldn't form any specific conclusions on this, other than money >>> honesty and principles for him, but why should we expect more from him than any other important person in Western society....this is just how we are. Despite the wonderful sounding platitudes we tell ourselves, this is our culture. And the Achilles heel that I believe China will be able to continue to exploit indefinitely, because I simply can't see it ever changing, it has become so normalized that hardly anyone can even recognize it anymore.

EDIT: Thinking more, with this being so obvious once you're aware of it, I can't imagine this is a unique theory I've come up with. Does anyone know a name for this style of thinking?

It’s time to stop being deluded. I’m going to stop paying premium for apple and assume all my devices are hostile by default.

What the actual fuck Apple.

What veracity? He is a businessman in a trillion dollar company. He says what pleases the market -- the domestic and the foreign one, not his personal beliefs...

The first priority is always profits or growth.

If one sincerely cared for the environment for example, would stop tons things that Apple is doing, not just one. The CEO of a multinational churning consumer gadgets by the shit-loads only cares for the environment to the degree that said caring doesn't impact the bottom line.

>Why should users believe that (closed source) iMessage encryption is free from backdoors when we know that Cook will dance around sensitive truths?

Well, that's an easier thing to answer, because there would be leaks from Apple employees (NSA had leaks, for Apple it would be many times easier) if that was the case. Tons of engineers would know.

>And why should the US government be satisfied with a fully encrypted iMessage given that Apple will cave to demands given enough pressure?

Because Apple will also cave to their demands.

Besides it's another thing to please some foreign customer by caving in to remove an app (especially if said foreign customer is a sovereign state and the app is anti-policy -- companies are not in some obligation from the US or otherwise to side with protesters), and another thing to e.g. cave in to China and give them a backdoor to iMessage as you seem to imply as a potentiality. In fact the latter would be treason (or close) for a US-based company and have much more serious repercussions...

That's an easy one: the encryption happens client side and thus any backdoor has to sit on the clients and, if it exists, would be available to security researchers. There is no guarantee of it happening, but I believe some of those researchers reverse engineer whatever binary apple published and then check it for backdoors.

Of course there are still tricks that apple could pull, like adding backdoors only to targeted phones, changing the filesystem to present one version of the binary to the OS command that executes it and another to anyone else (like security researchers), extracting the unencrypted message contents using chips that sit on the memory bus (e.g. baseband), etc. But these tricks are harder to pull off and are still detectable as they happen on end-user devices.

They definitely won't say "yeah there is a backdoor". Ultimately, you need to trust them.

Complying with the data request would have given users who had their data obtained standing to sue Apple, so Apple's willingness to litigate the issue went so far as the cost of the lawsuits it wanted to avoid. The FBI dropped the case not because it didn't think it could win but because it could access the data more quickly using another vendor's data extraction service.

It doesn't seem to me to take much of a leap of faith to think that China is applying pressure on the Hong Kong Cybersecurity and Technology Crime Bureau to get this app removed.

That would make it obvious that Apple is complying with law, and that they haven't "bowed to pressure" from either side.

If there is a claim that the app is violating law, then that should be validated by a judicial process, not by the operating nuances of a company.

If Apple are receiving reports from users that the law is being broken, they should be passing those on to law enforcement, and publicly complying with the response, not acting as their own arbitrator.

Yes, it's a reasonable demand. If public opinion is asking something of Apple, and its CEO chooses to answer, every aspect of the answer is open to scrutiny. Gruber indeed lists the specific evidence he would expect:

> - When was HKmap.live “used maliciously to target individual officers for violence”?

> - When was it used to “victimize individuals and property where no police are present”?

> - What local laws in Hong Kong does it violate?

It's unlikely that a CEO would be so thorough. Apple is particularly obsessed with secrecy, and tech companies in general seem to not want to disclose details when they restrict access to a product or platform.

But it's still a reasonable demand from an individual standpoint.

And beyond the actions of the Chinese government, corporations like Apple have no integrity upon which to base trust for them anymore. They need to cough up real proof instead some canned response that basically tells us to trust them on blind faith alone.

That's seriously disingenuous. His complaints is about how what Tim wrote doesn't make any sense, not about evidence. He only ask for evidence because he is logical, he knows that he may have not thought of everything and could be potentially wrong.

> The first allegation is that “the app was being used maliciously to target individual officers for violence”. This makes no sense at all. The app does not show the locations of individual officers at all. It shows general concentrations of police units, with a significant lag.

How could you explains this? I don't even need evidence, just a way for that to be possible (without outside coordination, that would be just absurd, simply use the same channel to coordinate instead).

But those alleged crimes could not have possibly helped by the app, as has been pointed out: you don't get to see individual officers' locations and it does not show areas with no police at all either, just police hotspots (and technically, most areas even in a dense city like Hong Kong are without immediate police presence most of the time, anyway).

But even if we played devil's advocate and took the allegations of criminal activity that abused the app at face value, and assumed Tim Cook is not free to share specifics as the information might be confidential, he could at least answer what local laws were allegedly violated by the app itself. Those laws certainly are not confidential information.

The complaint is that Cook's claims are extraordinary and seemingly impossible on their face because of the fundamental nature of the app in question. Its purpose is to show the aggregated position of large concentrations of police, so as to let users avoid confrontations with them. How can such an app be used to "target individual officers for violence", since it provides no information about individual officers?

When so extraordinary a claim is made, hearsay evidence isn't the issue. What is necessary is an explanation of how the seemingly impossible is possible. Cook does not provide this or even address the apparent problem. A neutral person, reading Cook's memo without the proper background, might be mislead into believing the app in question does provide tracking of individual police officers. I don't accept this is an accident on Cook's part. I think he is deliberately attempting to mislead his own employees regarding the nature of the app, and as a consequence his decision to ban it.

Cook's cited but unenumerated "credible" information received from a government body and users only compounds the situation. Cook could provide plenty of additional material to support his claim. He could provide more detailed information on exactly what information was received, in what volume, and in what form. He could explain the efforts the company undertook to perform independent corroboration of the evidence. He could provide a detailed account of why, in this case, he believes an autocratic government currently conducting a brutal repression of its own citizens can be trusted to communicate honestly about it, given neither it, nor any similar autocratic government, has ever spoken honestly about similar situations in the past.

Fundamentally, the problem isn't whatever evidence does or does not exist. It is that Cook's memo is a weak, politician's attempt to justify a misdeed by making absurd claims for which he provides no evidence at all. He is trying to make a problem go away, not engage with a difficult situation as a human being.

Okay, but even if true, I've got very credible evidence that Twitter and Facebook (not to mention Safari!) have been used maliciously to victimize individuals and property. Will these apps be banned? If not, why not?

> So then, is the complaint simply that Cook is not providing direct evidence of these claims?

The complaint, I believe, is that nobody (including Cook) believes any of this. I'm sure he did get a message from the Hong Kong authorities (aka, the Chinese government) and at least one user in Hong Kong (aka, also the Chinese government) claiming the things he says they claimed. And he doesn't really believe they are true, but feels compelled to pretend he does, so he sent out the email, and now everyone else is being asked to pretend they're true too.

And Gruber is pointing out that they can't really be true, given the nature of the app. Which is quite right, but of course, it's beside the point. Cook isn't going to read Gruber's blog post, slap his forehead, and go "I've been hoodwinked!" and rescind the decision. He knows what he's doing.

> Is that a reasonable expectation? What evidence could Cook provide that would directly tie violence (we know that Hong Kong protesters have committed violence) to this particular app?

The claim is not that the app facilitated very particular types of violence, which we do not know has occured. (Although again, even if true, that's not a good reason to ban the app.)

Let's not give them a pass here, as it's quite obvious why they're accepting the Chinese statements at face value, because of how dependent they are on the Chinese market.

This is about money, not principles.

Why would one use this public app to target individual cops (when it doesn’t even reveal individual cops, and by virtue of its aggregation of data is likely to reveal groups of cops more often) when they could use any of the primary sources instead?

Maybe the other part is true, where criminals are using the app to target areas where cops are not present. That would actually make sense. But the first reason doesn’t add up.

The complaint is that the claims are not credible given what we know of the app's capabilities. How could an app that highlights areas of heavy police activity be used to single out and attack lone officers without backup? If his claims were plausible, it might be different, but extraordinary claims demand extraordinary evidence.

Makes me sad we have lost soo much respect for liberty that people feel compelled to play "devil's advocate" in favor of a totalitarian regime.

I think it is clear that any "evidence" that has come from " Hong Kong Cybersecurity and Technology Crime Bureau" should be rejected out right and not trusted at all

Further the fact that the app may have broken "local laws" should also have no impact at all on the discussion, we are talking about a Totalitarian regime with countless Human Rights violations, their local laws are objectively at odds with what anyone should consider just or proper

So it comes down "Does this app violate Apple Policies", given that apple like most companies write the rules so at any time anything can be a violation at their sole discretion then technically yes, but so could any app at any time.

At the end of the day allow me to Translate Apple's Statement SouthPark Style

"Like the NBA, Blizzard, and countless other companies, we welcome the Chinese censors into our homes and into our hearts. We too love money more than freedom. Long Live the communist party of China"

Couple that with the fact that no officers have been targeted individually in Hong Kong protests since they began, and you begin to see that the whole thing sounds fishy.

What is the law being broken that no one knows about, and the cases of violence no one has heard of?

Cook clearly made an extremely specific claim, not a general one about protesters being violent.

>the app was being used maliciously to target individual officers

> HK map app can't be used to "individually" target police because it doesn't have any granular reporting and as anyone in Hong Kong can attest, the police travel in large groups. Repeat: the app has no granular function. More like police here, tear gas there, road block here. (https://twitter.com/zeynep/status/1182384310873219077)

Also, if it does indeed violate a law, why can no-one tell us which law? Even the HK police deferred to Apple when asked about this.

If they have examples, they should share them. It would have been easy for Tim to put the dates and locations of incidents in his email. There are plenty to go around on the protestor side: look up what happened at the Prince Edward MTR station on 8/31, for example.

Please stop spreading lies unless you have evidence to back up your claim.

From [0]: "Apple has never made user data, whether stored on the iPhone or in iCloud, more technologically accessible to any country's government."

Disclaimer: mainlander here.

[0]: https://news.ycombinator.com/item?id=21209190

You’re absolutely right and for the vast majority of companies put in this position I wouldn’t be happy about their decision but I definitely wouldn’t hold it against them. That said, if ever there were a company in the history of the world whose users are rabidly loyal enough, whose economic contributions in China are substantial enough, and with the “Fuck You Money” necessary to do what’s right when it comes to China, it’s Apple.

And when you consider that Apple launched themselves into America’s living rooms with the “1984” commercial, I might even go so far as to say that Apple could have leaned in to whatever negative consequences they may have suffered as a result.

At the end of the day, Apple taking down the app seems like an expected outcome, and HK is outside of the great firewall, so anyone can still access the site. What's the problem?

That gives you a custom app icon, which opens as a live full screen map app w/o browser chrome.

This open mechanism to “sideload” what a regular user can’t tell the difference from an App Store app was the original iPhone app distribution strategy for both live and offline HTML5 apps, provided to developers before the App Store existed.

It remains relatively trivial to distribute apps this way.

If it can happen to Apple it can happen to anyone.

Would it be possible to divest from all of China except Hong Kong?

There are no winners in this game, only losers. Google make similar concessions for the Chinese government.

I say that as an Android user.

Plus, the idea that the app could be used for specific targeting of individual police has pretty clearly been debunked.

In the end its really just a question of whether you think Apple should be on the side of egalitarianism or unrestricted profit.

Do we care enough about Hong Kong customers? Not really - they are <8 million people!

Do we care about China? Yes, a lot. Both about the government and the 1.4 billion potential customers there!

I imagine you're a software engineer earning 100k per year. Would you take away a tool a group of people are using to try and fight for their freedom for $400?

Which is why I don't understand the outcry coming from what Apple is doing here.

[1] https://news.ycombinator.com/item?id=21211124

Also, HN explicitly will remove posts that offer nothing but flamewar bait. Both algorithmically and manually.

This open mechanism to “sideload” what a regular user can’t tell the difference from an App Store app was the original iPhone app distribution strategy for both live and offline HTML5 apps, provided to developers before the App Store existed.

It remains relatively trivial to distribute apps this way.

Start here:

https://developer.apple.com/library/archive/documentation/Ap...

Specifically, did Apple/Google/etc actively cooperate with the NSA (outside of court ordered warrants), or did the NSA break in, or did the NSA have agents within the companies.

If anyone knows differently and has a source the community would be very interested to hear about this.

https://chinatribunal.com/final-judgement-report/

Plus it's just not in the DNA of Apple to do side loading. Goes against the grain of everything.

If you’re going to end with this sort of false equivalence, it kind of colors the rest of your argument and makes me wonder if you are being disingenuous here. I further note that you make a lot of assertions with no facts to substantiate them, and refer to news reports on Hong Kong as propaganda, so perhaps I don’t need to wonder anymore.