The story that an iPhone owner’s personal data was leaked online while it was in the hands of an authorized Apple repair center should bring chills to any owner of Apple hardware out there.
And Apple’s response to the matter is even more worrying.
This incident happened in 2016 at a Pegatron facility in California.
It’s quite shocking.
Our devices contain a vast array of private and personal data, ranging from health and financial data, our communications, movements, and personal photos and videos.
The idea that someone could be going through this when a device is in for repair and go as far as to share that information is appalling.
Must read: I just found my lost AirTag… you’ll never guess where it went
Apple is a company that claims to put privacy at the core of everything it does. And yet, everything about how it handled this, to its inaction since, suggests Apple is more concerned about its image rather than user privacy.
The fact that Apple’s involvement in this was kept confidential, becoming public only as a result of a legal dispute between Pegatron and its insurer over the cost, doesn’t look good.
Now, there are always going to be people who end up in positions of trust that shouldn’t be trusted. It’s a fact of life. But Apple is supposedly leading the way when it comes to user privacy, and that should include the privacy of users wanting their devices repaired.
It’s unclear here whether the repair center asked for access to the iPhone in question, or whether the device was unprotected, but either way, the best way to prevent this from happening is to make it so that it can’t happen.
Just as some cars, such as Tesla, have a valet mode that secures certain features of the vehicle from access, Apple needs to implement a similar feature for its devices. This “repair mode” feature would allow repairers access to the device but no access to any of the data on the device.
This would be a great addition to newer devices, closing a privacy loophole.
I would also expect authorized repair centers to offer an environment where snooping on data, and being able to copy or share it, would be hard to do. I’ve seen secured repair facilities where CCTV is in use, the test networks don’t have access to the internet and are managed, and employees are not allowed to bring their own tech into the repair areas.
This is somewhat extreme, but as users are asked to trust Apple with more and more of their data, there needs to be a barrier between repair agents and the user’s personal data.
An alternative is a secure backup followed by a wipe before a device is handed over for repair, with the data reloaded following the repair.
I know that companies try to cut costs when to comes to repair, especially when it comes to warranty work, but for a company rolling in cash, that’s a poor excuse.
Also, while taking control of the privacy and security of user data during repair sounds costly, privacy breaches are costly, both in monetary terms and bad publicity.
Apple does offer users tips on getting their device ready for service, which shifts the responsibility to the user. Problem is, depending on what’s wrong with a device or how it is damaged, this is not always possible. For example, on an iPhone with a dead screen, suffering from water intrusion, or stuck in a boot loop, this isn’t going to be possible.
Owners should be confident they can send in their hardware for service without having that data snooped on even if they can’t securely erase it.
You might also think that this is a lot for Apple in response to a single case from 2016, but given that Apple wanted to keep this quiet, we must bear in mind that this could be the one case we know of out of many that we don’t.
Suppressing its involvement in these things isn’t helping secure end users. It just allows Apple to pretend that it’s not an issue.
And it clearly is a problem.
