New York Times Report on Apple’s iCloud ‘Hard Bargain’ in China

Monday, 17 May 2021

Big feature story reported by Jack Nicas, Raymond Zhong, and Daisuke Wakabayashi for The New York Times, “Censorship, Surveillance, and Profits: A Hard Bargain for Apple in China”:

But the iCloud data in China is vulnerable to the Chinese government because Apple made a series of compromises to meet the authorities’ demands, according to dozens of pages of internal Apple documents on the planned design and security of the Chinese iCloud system, which were reviewed for The Times by an Apple engineer and four independent security researchers.

The documents show that GCBD employees would have physical control over the servers, while Apple employees would largely monitor the operation from outside the country. The security experts said that arrangement alone represented a threat that no engineer could solve.

“Chinese intelligence has physical control over your hardware — that’s basically a threat level you can’t let it get to,” said Matthew D. Green, a cryptography professor at Johns Hopkins University.

It’s a big report, but the above is fundamentally true and gets to the heart of the conflict: physical access to the hardware in the facility is game over. But what’s missing from the whole piece is any serious discussion of what else Apple could do. Apple has no option other than to comply with Chinese law, or else stop selling products in the country.

Option A: Apple does what it did — store all Chinese users’ iCloud data on servers in China, under the ultimate control of the Chinese government.

Option B: Apple refuses to do so, and the Chinese government shuts down iCloud in China and probably bans the sale of Apple devices.

Is there an Option C? I don’t think there is. So one way to look at Tim Cook’s decision making on this is that Apple chose the option which allows them to continue making $50 billion a year in sales within China — that Apple’s decision making on this is driven by avarice over principles — principles that the company, and Tim Cook personally, emphasize as a pillar of the Apple brand.

So the argument against Apple’s continuing business in China is that if the company really believed what it says about privacy — “Privacy is a fundamental human right. At Apple, it’s also one of our core values.” —  they would refuse to comply with the law and effectively pull out of the market, tens of billions of dollars be damned.

But what about Apple’s customers in China? What would I want Apple to do if I were a Chinese citizen who wants to use an iPhone and iCloud? (And if I were a Chinese citizen, I would very much want to use an iPhone and iCloud.) There’s no hiding the fact that Option A is a gut-wrenching decision that goes against Apple’s stated brand values. Mark Zuckerberg has made Apple’s position in China his main argument that they’re hypocrites on privacy. But Option A is Apple’s only way to serve their own customers in China. Chinese iCloud users have less privacy than iCloud users everywhere else in the world. But that’s true of every aspect of life in China. The Times article even points this out:

People close to Apple suggested that the Chinese authorities often don’t need Apple’s data, and thus demand it less often, because they already surveil their citizens in myriad other ways.

Even with the multiple significant compromises Apple has made to comply with Chinese law, it feels entirely possible that using Apple devices and iCloud is one of the most private things anyone outside government leadership can do in China.

I can see the argument that Apple should have chosen Option B, and pulled out of the Chinese market on principle. But you’re living in a fantasy world if you think Apple taking a principled stand against these laws would have resulted in the Chinese government capitulating to Apple. China would have simply told Apple to get out. If you parse the details of this Times report, what we’re seeing is the negotiated middle ground. It’s hard to imagine another Western company being granted so much autonomy over its servers and services — even if, objectively, it’s an insecure level of control and an unacceptable amount of App Store content censorship.

Yes, it’d be principled for Apple to say it only operates its services in countries that allow a minimum level of privacy and that China doesn’t meet that standard. But it’s also principled to say they’ll provide Chinese users with the most privacy that Chinese law allows. They’re just different principles. What’s more important: abstract ideals or the actual lives of actual people using these devices?

The elephant in the room is Apple’s reliance on Chinese manufacturing. Apple could stop selling iPhones in China, and could pull the plug on these new managed-by-China iCloud data centers. The revenue hit would be a very tough sell to Wall Street, but I think Apple could make the case. (Or at least they could have made it a decade ago.) But what happens to Apple’s enormous can’t-be-replicated-anywhere-else-in-the-world Chinese supply chain operations? Maybe the Chinese government would simply allow Apple to pull its products from the Chinese market but allow their supply chain operations to continue, unabated — “No hard feelings”.

(Xi Jinping doesn’t strike me as a “No hard feelings” sort of guy.)

It’s disingenuous to argue that Apple’s compliance with Chinese law on data centers and App Store content is wrong or mistaken without offering up a plausible scenario for what else they could do. Or acknowledging that Chinese iCloud users would not benefit in any way by Apple pulling out of the country.

Does it help Apple feel comfortable with the path they’ve chosen that it’s the path that generates $40-50 billion in annual revenue? I’ll bet it does. But there’s got to be a sinking feeling within the company’s leadership that they’ve painted themselves into a corner on this. Apple can’t do what it does without the Chinese supply chain, yet China is an increasingly hostile power on the geopolitical stage.¹