By Dan Moren
November 18, 2016 12:32 AM PT
Apple syncs call logs via iCloud, but it’s more of an annoyance than security risk
Note: This story has not been updated for several years.
Kim Zetter, reporting for The Intercept, explains that Apple is backing up call logs for phone, FaceTime, and third-party apps using CallKit under iOS 10, as long as you have iCloud enabled:
The logs surreptitiously uploaded to Apple contain a list of all calls made and received on an iOS device, complete with phone numbers, dates and times, and duration. They also include missed and bypassed calls. Elcomsoft said Apple retains the data in a user’s iCloud account for up to four months, providing a boon to law enforcement who may not be able to obtain the data either from the user’s phone, if it’s encrypted with an unbreakable passcode, or from the carrier. Although large carriers in the U.S. retain call logs for a year or more, this may not be the case with carrier outside the US.
Okay, so, there are a few things going on here that have all got conflated into one story. Some of it is innocuous, some of it is a bit eyebrow-raising, and some of it falls into the inconvenience area.
First up, Apple is syncing your calls between devices logged in with your Apple ID. In theory, this is no big deal: Apple says that the idea is if you’re logged in to your iPad and your iPhone, you can see the same call record in FaceTime on both of them. Miss a call on your iPhone? You can return it from your iPad. Makes perfect sense as a feature from Apple’s perspective.
Second up, there’s no preference to activate or deactivate this service, nor is the user explicitly told that it’s happening. If you sign into iCloud, your call logs are being uploaded. Period. This definitely isn’t great, but it smacks of the kind of thing Apple does because it thinks it will be a convenience, not because it’s setting out to be malicious. (There was a time when Apple didn’t notify you when apps were accessing your microphone or your contact information either.)
Thirdly, there’s the retention of this information for several months. Again, I suspect that’s part of the “feature” of your call history. Some are concerned that it gives law enforcement a way to get your call logs with a court order, but a) as The Intercept itself points out, in the U.S., four months of calls is far less information than your carrier generally retains1 and b) as long as that information is being retrieved with a legitimate court order, that’s the way these things should work.2 (The exception in this case being FaceTime/third-party calls, which probably aren’t logged anywhere else, except maybe on the servers of Apple/third parties.)
Personally, I agree with the ACLU’s Chris Soghoian3:
“It’s arguably not even the worst thing about iCloud,” [Soghoian] told The Intercept. “The fact that iCloud backs up what would otherwise be end-to-end encrypted iMessages is far worse in my mind. There are other ways the government can obtain [call logs]. But without the backup of iMessages, there may be no other way for them to get those messages.”
There are definitely easier ways for the government to get your call log–at least for traditional phone calls–than via Apple. The same can’t be said for iMessage. (The Intercept does mention that Apple promised earlier this year it would be re-designing iCloud to make it more secure for customers’ data, but it seems like that project is still in the works.)
The bigger issue here is that Apple has made a big stand on privacy and being protective of its users’ data, and so it’s a bit at odds with that stated purpose to retain this information without notifying its users. If I had to bet, I’d guess a subsequent version of iOS will prompts users to allow this data to be synced, and let them opt out via the Privacy controls.
Last, but not least, there’s also a side issue of convenience, as exemplified by this anecdote:
“It’s very irritating,” one user complained in a forum about the issue. “My wife and I both have iPhones, we are both on the same apple ID. When she gets a call my phone doesn’t ring but when she misses that call my phone shows a missed call icon on the phone app and when I go to the phone app it’s pretty clearly someone who wasn’t calling my phone. Any way to fix this so it stops?”
To me this exemplifies another big flaw with Apple’s current system. Why are two people using the same Apple IDs? Probably because they want to have access to the same apps. Family Sharing clearly hasn’t solved this problem, so maybe it’s time for Apple to go back to the drawing board on both that, and the situation of having multiple Apple IDs.
- International carriers obviously may have different rules, and this may be more or less than in those cases. ↩
- If you want to get into the legality of the surveillance courts and whether or not they operate as intended, well I’ve got some bones to pick there as well, but that’s a different kettle of fish. ↩
- Hey, does that name sound familiar? It should! He’s the nephew of Sal Soghoian, former automation head at Apple, who we wrote a couple stories about this week already. What a coinky-dink! ↩
[Dan Moren is the East Coast Bureau Chief of Six Colors. You can find him on Mastodon at @dmoren@zeppelin.flights or reach him by email at dan@sixcolors.com. His latest novel, the supernatural detective story All Souls Lost, is out now.]
If you appreciate articles like this one, support us by becoming a Six Colors subscriber. Subscribers get access to an exclusive podcast, members-only stories, and a special community.