17 Dec Does Apple Spy On Its Employee’s Personal Devices?
A former engineer raises some eyebrows
– Melbourne, Australia – Dec. 17, 2021
Jacob Preston worked for Apple for three years, but he never did quite figure out why the company demanded that he use his own personal Apple ID to access his work-related accounts and services. But now, with the benefit of hindsight, he has some theories about what was really going on.
Back in April 2018, Preston began working for Apple as a firmware engineer — a job that would ultimately see him intimately involved with the charging firmware built into the company’s Apple Pencil stylus.
Among the many tasks during the employee induction was to set up a service known as iCloud@Apple, which upgraded employees’ personal iCloud accounts to a supercharged version that provides 2TB of storage.
In most companies, Preston assumed, employees would be given a separate work identifier to be loaded onto their work devices — but Apple “requires you to use your personal Apple ID to sign up for this,” he told Cybercrime Magazine.
“You go through these steps of getting all your software set up, and all your devices provisioned to access internal Apple networks, and things like that. And it explicitly says you cannot use your corporate Apple account to set this up.”
That seemed like a strange demand from a company that is notoriously careful about security and privacy, to the point that CEO Tim Cook has been quite vocal about its importance.
Cybercrime Radio: About Apple’s Employee Privacy Policy
Former Engineer Raises Some Eyebrows
Surely such a company would want to avoid mixing employees’ personal content with its business interests, Preston figured — until he began wondering whether its real intention was to do exactly that.
As a company that thrives on secrecy and holds its employees to strict non-disclosure standards, he realized that the demand employees use personal Apple IDs — turbocharged by a service built specifically for employees — could potentially use the service as a Trojan horse that would let them scour personal iCloud accounts for proprietary information.
Ultimately, he had no choice in the matter and was nervous about antagonizing his new employer, so Preston went along with the instructions and got on with his job.
Maybe, he thought, Apple was just “dogfooding” its employees — forcing them to design technology more carefully by forcing them to use everyday accounts rather than gifting them the latest-and-greatest technologies.
Over time, the 2TB of space proved to be far more than what he needed for work, so he began using it to store personal financial and other documents.
All your bytes belong to us
Three years passed before Preston’s ears perked up again, as he began working through Apple’s offboarding checklist and noted an item, written in bold letters, that instructed employees not to wipe their work devices of data before returning them to Apple.
Thanks to the earlier demand that employees use personal iCloud accounts for business, both types of data had been synchronized and intermixed to the point that the company’s instructions were problematic.
Demanding that devices be returned unwiped may well have been a way to make sure forensics experts could detect any unauthorized proprietary Apple information stored on the devices — but it would also have meant handing over devices loaded with Preston’s own financial details, documents, and other personal information.
That’s where I put my foot down and said, ‘I’m not going to do this when you’ve asked me to use my personal Apple ID for work-related things; I don’t want that to be intertwined or mixed with anything,’” Preston recalled.
“I remember speaking to my manager about this and trying to get more context about why Apple needs me to return my devices in an unwiped state,” he said.
“When I’ve already given you all the relevant documents, all my code has been pushed to the repository and you have everything that could possibly have a value already, why do you need this device back unwiped? And he said ‘I don’t know, it’s just policy.’”
Preston readily admits that his possible explanation — that the devices are being sent to a central site to be closely checked “to see if you had done anything malicious, at least in your last few weeks at Apple” — may be entirely speculative.
After conversations with peers, he decided to wipe the devices anyway — “the safest thing for me,” he said, “but that created a big stink with my management. And they pushed really hard to try to get me not to do that.”
Preston’s experience at Apple seemed even stranger when he went through onboarding at his current employer — Synapse, where he currently works as a software/firmware engineer — and was given the option of setting up Managed Apple IDs, which were introduced for business use in 2020.
Synapse had Preston install the Microsoft suite of tools on his iPhone for work use, he said, “but it’s limited to those apps; anything else that’s on my phone is mine, and those apps are the only thing that they could have a back-end access to.”
Now that he’s outside Apple’s Cupertino bubble, Preston isn’t sure whether employees are using the new business service or are still instructed to use their personal Apple IDs when setting up work devices — but the experience has left him skeptical about Apple’s true commitment to privacy.
“Now I don’t give Apple a blanket endorsement for everything,” he said. “I still think their hardware is the absolute best, but where my opinion about them has drastically changed is in the privacy aspect of things.”
“Being an employee, you understand that they have various tools to look at what you’re doing — but my opinion has been a little bit tainted.”
– David Braue is an award-winning technology writer based in Melbourne, Australia.
Go here to read all of David’s Cybercrime Magazine articles.
