Apple settles with student after authorized repair workers leaked her naked pics to her Facebook page

Apple has paid a multimillion-dollar settlement to an unnamed Oregon college student after one of its outsourced repair facilities posted explicit pictures and videos of her to her Facebook page. According to legal documents obtained by The Telegraph, the incident occurred in 2016 at a Pegatron-owned repair centre in …

[Throatwarbler Mangrove]

In before . . .

. . . the Apple fanbois and other assorted neckbeards start up with the victim-blaming. To get out ahead of your criticisms, we don't know the nature of the required repair, so it may not have been possible for the student to remove the intimate material, and, in any case, the fact that she did not in no way implies that it was appropriate for repair shop staff to a) go rooting around on her hard drive and b) post the material to Facebook. Furthermore, the fact that she has a Facebook account in no way makes her a lesser person deserving of scorn, ridicule, or public humiliation, no matter what the commentard community may think.

Does that cover all the bases?

[yetanotheraoc]

Re: In before . . .

Comparing your "In before ..." post #1 with "How to tell if you're stupid." post #2 immediately after, I would say you covered it.

[MrBanana]

Re: In before . . .

Someone stole their Edit Post button.

[45RPM]

Re: In before . . .

I can’t thumbs up this enough. Victim blaming is never acceptable, no matter what the circumstances are.

[Ian Johnston]

Re: In before . . .

"Victim" is not a boolean variable. Some victims aren't to blame, sure, but some are partly or wholly to blame for what happens to them. Easy example: the courts decided that George Zimmerman was entitled to defend himself with lethal force against Trayvon Martin. Do you think that he, as a victim, was entirely blameless?

[Anonymous Coward]

Re: In before . . .

If you sat and listened to ALL the evidence then yes. Trayvon was on top of him, beating him at the time of the shot. Trayvon, instead of just walking away jumped George.

Why anony? Because it appears if you defend George's actions you're deemed racist when in fact you've just listened to all the evidence and sat through the whole court trial.

[Anonymous Coward]

Re: In before . . .

https://www.washingtonpost.com/news/morning-mix/wp/2016/08/05/youre-bragging-about-that-george-zimmerman-assaulted-after-boasting-about-killing-trayvon-martin-police-say/

[Michael Wojcik]

Re: In before . . .

I think you should avoid pronouns with ambiguous antecedents, is what I think.

[MrDamage]

Re: In before . . .

Unless you run a "secure" for-profit carpark, or are police. In which case it seems to be perfectly acceptable to blame the victim if their car gets broken into and contents stolen.

Cunts.

[macjules]

Re: In before . . .

To have logged in as the user, rummaged through her personal photos and then posted them onto Facebook is a crime, without any doubt. If that had been her bank account they logged into, because she left her banking details in a Note, would there have been any excuses then?

[cb7]

Re: In before . . .

Yep. Covers all bases, except there ain't no pussy pics out there worth $5m

[gnasher729]

Re: In before . . .

What makes you think anyone would start blaming the victim?

Oh my god, I read some more posts and there they come…

Nude pictures sent to your boyfriend/girlfriend and they get shared: Cut his balls off. Blame yourself for the shared pics. He can blame himself for his loss.

Nude pictures on a phone without passcode get stolen: Blame yourself. If you find the perp see above and he can blame himself.

Nude pictures on a phone that you hand to Apple for repair: Blame the idiots who copied them, collect money from Apple. If you’re Apple, find the perps and see above.

[Snowy]

Re: In before . . .

or if your Apple pay out way to much and use that as ammo against right to repair?

[TheMeerkat]

Re: In before . . .

Try to make as much money out of independent repairer as she did out of Apple.

This is a good reason to repair with Apple.

[MachDiamond]

Re: In before . . .

"Try to make as much money out of independent repairer as she did out of Apple.

This is a good reason to repair with Apple."

An independent repair shop survives on its reputation and word of mouth advertising. A good one may be a sole trader or will have the owner on site, Mucking around with customer's most private will be a major sacking offense even if they do have a bit of a look in-house. You also know where your phone is. It's not being sent to some third party contractor that does the work on Apple's behalf which sort of makes that company an independent repairer. If the repair is something as straight forward as a screen replacement, which is one of the biggest reasons phone's are in for repair, a local independent shop can often do it while you wait or the same day.

Louis Rossmann in the US is a big campaigner for "Right to Repair". There are laws in place for cars, but consumer electronics need their own. He specializes in Apple laptops and it often frustrated with a lack of documentation and restricted parts availability. I started out working on pro audio electronics and there were several companies that thought their schematics were so sensitive they wan't NDA's up the wazoo to be able to spend gobs of money to get them. They weren't. Most gear was pretty similar. The real magic was in using higher quality parts and good PCB layout. Back in the day, a big mixing console might have half a tree in the service manual so it cost real money to print and stock. These days it's a PDF and there is no inventory. Not everybody can just bin something that breaks and buy a new one. Having kit that can be repaired is important. I also think it's good advertising. Many things have a second life after being repaired which means that brand winds up everywhere. If everybody is using Yamaha pro audio gear because it can be found on the used market at a good price and it's easy to get serviced, people will look for it since "everybody is using it". If it has to be binned as soon as a knob gets snapped off, there will much less in the wild.

[MachDiamond]

Re: In before . . .

"Nude pictures on a phone that you hand to Apple for repair: Blame the idiots who copied them, collect money from Apple. If you’re Apple, find the perps and see above"

Yes, but I will always say it was a huge mistake to have the photos/video on the phone in the first place. You should be able to leave a bundle of cash or paperwork from you bank in your car when you take it in for service, but it's still a really bad idea.

I've learned through numerous news articles that having anything on your phone that's incriminating, embarrassing or financial is a huge mistake. Not that I have much of anything on my phone, but the little that is lives on a removable memory card. I wouldn't have a phone that doesn't have a removable memory card. If I were to leave my phone somewhere for service, the card would be out first. If I need to change phones, it's a dawdle to swap the SIM and SD card. If I thought there was sensitive information on the phone that I couldn't move or delete due to the phone being broken, I'd get a new phone and fix the old one with a big hammer. I see buying cheap phones as a huge advantage for that reason. A $1200 iPhone under warranty can be worth fixing, but I don't think they are worth buying. For me it would just be an expensive toy that doesn't give me any advantage in my business over something I can pick up used for £25-£75. The only phone I'd spend big money on if I had a windfall from something would be the CAT phone with the IR camera built in. IR would be a useful feature to have with me all of the time for trouble shooting. The bonus with that phone is it is also constructed for hard use. The downside is it won't go in a pocket.

[FlamingDeath]

Re: In before . . .

Personal responsibility….

Where is it?

I dont have pictures of my private parts on an internet connected device because I’m not an unthinking moron.

This is akin to a woman going to go get a brazilian butt job and when it goes wrong, blames government for not stopping her

The phones might be smart, unlike many of their dumb as fuck users

[Anonymous Coward]

Re: In before . . .

FlamingDeath I dont have pictures of my private parts on an internet connected device

Because you don't have any? Like a Ken doll?

[Yet Another Anonymous coward]

Re: In before . . .

>I dont have pictures of my private parts on an internet connected device because I’m not an unthinking moron.

That's your choice, and probably as an el'reg reader an aesthetic one.

But you shouldn't have to self-censor images of yourself and partner because you can't trust the computer maker

[TeeCee]

How to tell if you're stupid.

If you take nude pics of yourself, you're probably stupid (and vain).

If you keep nude pics of yourself on your phone / computer / tablet / whatever, you are definitely stupid.

And if you leave them on there when you send it in for repair, congratulations, you just made yourself the poster child for stupid.

As always I am disappointed to see the legal system reward stupidity, it just brings the idiocracy closer.

[MrBanana]

Re: How to tell if you're stupid.

Try substituting 'nude pics of yourself' with 'pictures of my mother dying alone in a hospital bed'. The total disregard for personal privacy is the issue here, not the actual data involved.

[cornetman]

Re: How to tell if you're stupid.

> Try substituting 'nude pics of yourself' with 'pictures of my mother dying alone in a hospital bed'. The total disregard for personal privacy is the issue here, not the actual data involved.

Not only that, perhaps substitute images or any information that you hold in a professional capacity that you have a responsibility to keep private.

On Louis's YouTube, there is a dumb as f*ck commentator who calls himself "Spenser" trolling for Apple making the same arguments as to the alleged stupidity of the phone's owner. Trivial damage to a phone could easily make it non-functional, a failed battery or charging socket, a cracked screen that makes the display unreadable so that the data couldn't be removed before shipping. And the data is supposed to be encrypted.

As stated by others, this is a huge breach of privacy expectation by an Apple contractor and they should be slapped down mercilessly.

[redpawn]

Re: How to tell if you're stupid.

You send your computer to professionals. You should be able to expect them to be as discrete as a therapist. There are plenty of opportunities to look at porn already on the internet so no reason to commit a crime to post more just to damage and embarrass your customers.

[Blank Reg]

Re: How to tell if you're stupid.

Yes the repair people are 100% liable here. They should know better and must be held accountable.

On the other hand I've told my kids to never take a photo that you wouldn't want to show your grandmother. Either by accident or by malice there is a good chance such photos will one day end up where you don't want them to. And once that happens good luck purging them from the internet.

[jason_derp]

Re: How to tell if you're stupid.

I told my kids never to possess or create ANYTHING that they wouldn't want anyone to look at or think of. It's why Tuesdays are "flay off the skin" days. They complain now, but if they live to the age of majority, I'm sure they'll have enough function to create a noise that sounds like a "thank you".

[Anonymous Coward]

Re: How to tell if you're stupid.

"I told my kids never to possess or create ANYTHING that they wouldn't want anyone to look at or think of."

That sounds like the "anyone" has Orwellian control by claiming "authority" over people's lives, self-expression, and thoughts. Read some of the autobiographies of life as a child in some Scottish islands where religion punished kids' play on a Sunday.

[MachDiamond]

Re: How to tell if you're stupid.

"I told my kids never to possess or create ANYTHING that they wouldn't want anyone to look at or think of."

It's a good lesson. I've seen people that have been utterly destroyed by a workmate they trusted when it came time for promotions or getting credit for something.

[big_D]

Re: How to tell if you're stupid.

I agree. I've never understood people taking naked pictures of themselves or leaving them on their personal devices. Certainly not something I would do or recommend. Same with any confidential information, don't leave it where others can abuse it. But if people want to do that, that is their choice and if they have nowhere else to store them, or the device breaks, before the images can be removed, that isn't a free card for the repairers to post them online.

A device breaking, so that you can't remove the information, before sending it in for repair, definitely doesn't make you stupid or justify "victim blaming".

The lowlifes working for Apple/their agent are the ones in the wrong here and Apple's and Pegatron's vetting and control procedures.

[BrownishMonstr]

Re: How to tell if you're stupid.

I have images of my wife during pregnancy. Very unflattering, but neither of us would want the photos to be exposed. I also have photos of my 3yo daughter.

If some stranger goes snooping and looking at the photos, I would have a strong urgency to punch the twat, no matter how likely it is they will win the fight. I'm not the type of person to fight, but I'd do it in that scenario.

The only reason to look at photos is to maybe test the camera. No other fucking reason exists.

All phones should come with a repair mode to restrict the OS to extremely basic functions, sandboxing apps like the camera and photos.

[Anonymous Coward]

Re: How to tell if you're stupid.

The Xiaomi File Manager App has a simple password protected "Private File" option which removes files from prying eyes.

[Anonymous Coward]

Re: How to tell if you're stupid.

So you feel that that the stuff on Gary Glitters laptop would have been better never being found, and should have been ignored if it was found?

[MarkTriumphant]

Re: How to tell if you're stupid.

For that case, the police should be informed. If they are not illegal, they should be left alone, not published on the internet.

[Martin]

Re: How to tell if you're stupid.

Read what the article said.

...two technicians published a series of photographs showing the complainant unclothed to her Facebook account, as well as a "sex video". The complaint said the post was made in a way that impersonated the victim, and was only removed after friends informed her of its existence.

Which makes me wonder if this was actually someone who deepfaked her? We may never know, as they've settled with a non-disclosure agreement.

But in any case, saying that leaving nude photos on a phone means it's your fault they got spread around the internet is the same argument that wearing a short skirt means it's your fault you got raped.

Downvote duly administered.

[Woodnag]

....continued to strengthen our vendor protocols

Don't worry, it's won't happen again becuase Apple said they will "continued to strengthen our vendor protocols" which means have signs saying don't do it with bigger letters.

[Brewster's Angle Grinder]

Re: ....continued to strengthen our vendor protocols

Or they could put some more small letters in the contract. Letters like, "You will be liable for our damages if you violate these protocols."

[MachDiamond]

Re: ....continued to strengthen our vendor protocols

"Or they could put some more small letters in the contract. Letters like, "You will be liable for our damages if you violate these protocols.""

I'm sure that's already in the employee manual that didn't get read as HR wanted it signed at hiring with just enough time to leaf through to all of the places that needed initials and signatures.

Repair techs at a big contractor get paid F-all. There isn't any way they'll ever be able to pay for just the attorney fees. Apple, on the other hand, has lots of cash on hand. They're known for it and the contractor they hired to do their repairs is Apple's problem as customers are sending their items to be repaired to "Apple". How Apple subs that out is Apple's decision. For a while, if you sent a guitar amplifier to Fender for repairs, I was the one that may have been doing the work at a repair contractor. If you were an endorsed artist, I was definitely the one doing the work and will have been told to drop everything else and get on it.

[big_D]

Re: How to tell if you're stupid.

Apart from deep fake bit, I agree.

Probably, Facebook app still installed on the defective device, like the photos still on the device, because they could not be removed - hence the reason for sending the device in for repair.

[werdsmith]

Re: How to tell if you're stupid.

the post was made in a way that impersonated the victim

I took this to mean that the post was done under the victim's account giving the impression that she had posted them herself.

[Martin]

Re: How to tell if you're stupid.

Fair enough. You're probably right, thinking about it. Though that in itself is pretty damn creepy - not only posting the pictures, but posting them to make it look like she'd done it herself.

I imagine the FB account was open on the phone, and they justified what they did to themselves by saying "That'll teach her to be more secure with her account details...!"

The more I think about it, the more I'm disgusted with these lowlife creatures. In what universe is that reasonable or funny? I imagine they've been sacked, but I'd like to think they were prosecuted for it. Presumably the reason Apple paid out so much money is to avoid the embarrassment of their oh-so-secure store repair technicians being prosecuted.

[Anonymous Coward]

Re: How to tell if you're stupid.

I wonder if TeeCee realises just how incel he sounds?

[Anonymous Coward]

Re: How to tell if you're stupid.

Yup, he just needed to refer to her as Stacey and be done with it....

[NotBob]

Re: How to tell if you're stupid.

If you take nude pics of yourself, you're probably stupid (and vain)

If you keep nude pics of yourself on your phone / computer / tablet / whatever, you are definitely stupid.

And if you leave them on there when you send it in for repair, congratulations, you just made yourself the poster child for stupid.

As always I am disappointed to see the legal system reward stupidity, it just brings the idiocracy closer..

How to tell if you're stupid, indeed. If you unironically hold these views, it's probably safe to assume you are.

[Phil O'Sophical]

Re: How to tell if you're stupid.

poster child for stupid.

Stupid or not, there's still no excuse for someone who happens to find those photos then sharing them. That's what Apple has paid up for. If the repair tech had simply admired the images and fixed the phone there wouldn't have been a problem.

[Throatwarbler Mangrove]

Re: How to tell if you're stupid.

I think a good way to tell if someone is stupid is that they receive a person's electronic device for repair and then violate the person's privacy in a very public way which leads directly back to the repair shop. If the techs had just rubbed one out to the pictures, it would be creepy and disgusting, but no one would ever know. Posting the pictures publicly when only a very short list of people would have access to those pictures is the very distilled essence of stupidity.

[tfewster]

Re: How to tell if you're stupid.

There have been cases of technicians finding illegal materials, e.g. child porn, and reporting it - as you would expect IF they found something.

Though it was not clear if the illegal materials were found accidentally, or if the technicians routinely went looking (for themselves, or a fishing operation for law enforcement).

Cameras and/or managers overlooking the repair benches might deter snooping. That might seem intrusive and degrading to professionals - but I'd rather have proof I did no wrong than the unverifiable suspicion that I'd erred

[MachDiamond]

Re: How to tell if you're stupid.

"Cameras and/or managers overlooking the repair benches might deter snooping."

Ever seen CCTV recordings? There's no chance they be able to resolve what the tech was doing on the phone. About all they'd be able to determine is that the screen was lit and the tech was doing something. I don't think that it's cost effective to have a supervisor that spends their whole day shoulder surfing the staff. Chances are that they have their own laundry list of make work that the higher ups demand be done or no bonus.

[Rol]

Re: How to tell if you're stupid.

I have pictures of my bum on my phone, 'cos I much prefer to diagnose my ailments for myself, before troubling my overworked doctor.

I also have pics of me fully clothed, because I find looking in the mirror just doesn't seem to work the same. I'm not vain, just conscious of the fact my career prospects are not improved if I stroll into work looking like a wanker from a 70's porn film. I'm sure many people do exactly the same, as it's far easier to see the whole picture on a screen than in a reflection, or maybe wanking to all those 70's porn films did send me blind...hahaha

I also repair my own phones. Admittedly some fixes involve a big hammer and a recycling bin, but seeing as I have never paid more than a tenner for a phone, it's not a big loss.

If you can go to Germany and watch them building your car, or an old time watch repairer fix your Rolex in front of you, then why can't you sit and chat with the genius as they fix your iphone and thus dispel any worries that you might get it back a little stickier than you sent it?

[Falmari]

Re: How to tell if you're stupid.

@Rol "I have pictures of my bum on my phone" I still use the tried and tested photocopier method. :)

What does it matter if your are vain? Does vanity make you less of a victim?

Judge "I find in favour of the plaintive compensation value set at $5 million. Reduced by 50% to $2.5 million because I find the plaintive to be a vain bastard.

@Rol your are right we are all going to have data on our phones that is private. Actually every thing our phones is private.

[PRR]

Re: How to tell if you're stupid.

> If you take nude pics of yourself

Twice this month I have taken "nude" pictures on my phone. FOR A DOCTOR. In this COVID world, and backed-up medical services, especially way back in the woods, it is making sense to send pictures rather than schedule and attend a follow-up.

Friend had a suspicious growth cut off her back. The picture is her naked scabbed back, not so erotic.

Dog had major urinary trouble. The only vet who would do it is 200 miles away. Normally we would go back 2 weeks later for follow-up. We opted for a very gross close-up photograph of the dog's poor crotch.

Wondering if this adds enough to the topic to pass moderation.

[PRR]

Happening already...

me> Twice this month {June 2021} I have taken "nude" pictures on my phone. FOR A DOCTOR.

https://www.theguardian.com/technology/2022/aug/22/google-csam-account-blocked

"Google has refused to reinstate a man’s account after it wrongly flagged medical images he took of his son’s groin as child sexual abuse material (CSAM), the New York Times first reported."

[Phil Kingston]

Re: How to tell if you're stupid.

Geez, in all my years of coming here I think that's the most downvoted post I've seen.

I keep naked pics of myself just to remind me how much of a fecking legend I am, it doesn't make me stupid. Vain? Perhaps. But hard not to be when rocking this bod.

[David Neil]

Re: How to tell if you're stupid.

I see the puritanical streak in the US is alive and well TeeCee

[MachDiamond]

Re: How to tell if you're stupid.

"And if you leave them on there when you send it in for repair, congratulations, you just made yourself the poster child for stupid."

Wow, the elRegverse seems to believe that everyone at repair shops are angels. It would be such a beautiful world if we could all trust each other and spend whole sunny afternoons watching the flying unicorns flap by and think lovely thoughts. The real world, on the other hand, is filled with people that can't be bothered to think if something sounds like fun in the first millisecond. "Consequences? Who cares? If they sue me I have nothing worth taking." Some people might turn in a credit card they find on the pavement, but many will see it as an opportunity to buy a new big screen TV or fill their tank with petrol before it gets reported as lost. Chip and PIN would be completely unneeded in a totally honest world.

The world is not a kind place. It's your own responsibility to look after yourself and have a sensible amount of cynicism or you are going to get burned. You don't hand your house keys to a sketchy "friend" and tell them you are going on holiday for 10 days if they are the sort of person that would print up flyers and have a big party at your home while you're gone. If you've taken your young kids to the park to play and need to spend a penny, you don't ask some random guy on a bench to mind them for you while you visit the loo. You must take time to play the devil's advocate and plan what you would do "if". IF you would suffer some harm from nude photos of you being circulated, it's best not to have them stored "in the cloud" (just ask Jennifer Lawerence) or on a small device that could go missing in a femtosecond. An iPhone can be a good haul all by itself, but it could be a really big bonus if the owner could be blackmailed into handing over even more money for its return.

[Howard Sway]

Demand 100% control : accept 100% liability

It was an Apple authorised repair outfit. And I'm guessing that Apple authorisation doesn't come cheap or easy. So if any person in any of Apple's control freak supply or repair chain screws up in any way, then Apple should be liable.

And what applies to nudie pics applies just as much to any work or other private data on somebody's machine. It should not be touched by the repair people.

[iron]

Re: Demand 100% control : accept 100% liability

> I'm guessing that Apple authorisation doesn't come cheap or easy

You'd be surprised.

An official Apple repair centre in the UK used to be a customer of mine, I did maintenance on their thermal transfer printers whenever a field service colleague was on holiday but I'm really a developer. One time when Apple introduced a new PSU for a laptop I was asked by a manager at said repair centre if I knew how to repair it. They couldn't even get the thing open because the special tools hadn't arrived from Apple yet.

I couldn't do anything with it either but my point is I was a random, unqualified third party who has never owned an Apple product and they asked for my help. They would regularly call us out to fix faults that turned out to be print head needs cleaned despite their own staff of on-site engineers.

I wouldn't trust that company to rewire a 13 amp plug let alone fix a smartphone or laptop.

[yetanotheraoc]

Details

"In its fight against the right to repair, Apple has argued that allowing independent third-party businesses to service its computers and smartphones would present an unacceptable risk to user privacy and security. (p/) This incident, which occurred at the facilities of an authorised contractor, has undercut that argument somewhat."

I'm not sure it does undermine Apple's argument. Doesn't that depend on those pesky details? How much effort does Apple *actually* put into safe-guarding privacy at 3rd parties? Versus how much effort do / will / would independent shops put? And what would be the rate of incidents at various levels of effort? Apple's vendors have notably failed, but that doesn't tell us much about effort or rate.

[MrBanana]

Re: Details

"Apple's vendors have notably failed, but that doesn't tell us much about effort or rate."

Apple's effort - slap a non-disclosure on the whole thing. The rate of incidents should be zero. anything else is unacceptable.

[yetanotheraoc]

Re: Details

Zero defects with _people_ involved. Wow.

[MrBanana]

Re: Details

It is what Apple has decreed in the second decade of the new freedom- the just repairers are not mortals. Hail the the anointed, only they shall be sanctioned to fix the iThingy. Let the Apple, righteous repairers release the daemons from the holy device. Sacred are the repair manuals - let them never be seen in plain sight.

[EveryTime]

Re: Details

Apple is claiming in court that they shouldn't have to release repair information because consumers going to third parties for repair is a theoretical privacy risk.

This story is about Apple's "in house" (which is really contracted out) repair being a proven privacy failure.

Does that tie it together for you?

[yetanotheraoc]

Re: Details

I'm actually amused by the number of downvotes I am getting for a rational post. Change the names of the defendants from Apple and vendor to *you* and your helper and I think the details might suddenly start to matter.

The poor customer was wronged, no doubt. The lawyers did their thing which did not make it all better but then nothing could.

My point stands. Apple and vendor failed, but would an independent repair shop do better? Maybe yes, maybe no, it all comes down to details.

[MrDamage]

Re: Details

So Apple has shown they do nothing about your security and privacy in respect to third party repairs. The most that will happen, if the 3rd party misbehaves often enough, is they will lose their Apple certification.

What does losing your Apple certification mean? You no longer have to send Macs older than 5 years to the landfill, as you are now allowed to repair them how you see fit.

Will an independent repair shop do better? Let's face it, they can't do any fucking worse.

[gnasher729]

Re: Details

You missed about five million important points in your analysis.

[doublelayer]

Re: Details

"You missed about five million important points in your analysis."

As useful as that comment was in enlightening the person who wrote the original comment and those of us reading it, perhaps you'd care to list some of the important points? You obviously know what they are. Due to comment size limits, perhaps you can split it into five posts of a million reasons each. I assure you we wouldn't mind.

[Dinanziame]

Re: Details

I assume they mean 5 million times "1 dollar".

It's true that Apple-approved workers can violate your privacy just like anybody else; but only if they are Apple-approved will you receive $5M for your trouble.

[MachDiamond]

Re: Details

"but only if they are Apple-approved will you receive $5M for your trouble."

Maybe. The award is going to be appealed and that could take another 3-4 years with attorneys eating up a large percentage of the money. If the award was $250,000 and attorney fees, there'd be a check cut the next day. The last thing Apple want's to have is a precedent on the books. If (when) something like this happens again, they don't want the plaintiff's attorney to pull up the case and have a good basis for another huge payout.

[doublelayer]

Re: Details

Let me clear up the problem.

"My point stands. Apple and vendor failed, but would an independent repair shop do better? Maybe yes, maybe no, it all comes down to details."

The answer is no. An independent repair shop would not necessarily be better. Some could do the same. However, that is not an excuse for Apple to ban them on privacy grounds when Apple-certified people are doing just as badly. That is the argument. Not that independent repair is always better, but that the excuse provided by Apple for not allowing it is completely incorrect as proven by this example.

[elwe]

Re: Details

By restricting the supplies of spare parts, knowledge of how to make the repair etc. all Apple ensure is that people cannot repair their devices themselves, which would remove all the risk of this sort of thing happening.

If the device had a high ifixit score, widely available parts and published repair manuals the student could have repaired it themselves, used a trusted friend, or shopped around for someone who would do the repair while they waited and watched.

The victim should have been able to trust Apple's repair service, but they shouldn't have to. If Apple want to play games with their spare parts etc. they should be forced by law to offer an equivalent of the keep the hard drive service server makers offer to customers who value their data. That means no sending off the phone, walk into an apple shop, demonstrate it is broken and if they can't fix it in front of you, they have to issue a replacement then and there. If they can fix it, you still get to keep/personally destroy the flash memory if it is replaced.

[yetanotheraoc]

Re: Details

Agree with your post and upvoted. End user repair is free from privacy concerns, end user watching the repair process likewise.

[Falmari]

Re: Details

@yetanotheraoc I am surprised at the down votes it was a rational and reasoned post. But I believe that this case has undermined Apple’s statement on privacy risks and third-party repairers. Part of your post shows it has, you believe it is possible for an independent to do better.

I will quote you “My point stands. Apple and vendor failed, but would an independent repair shop do better? Maybe yes, maybe no, it all comes down to details.”

So, it is possible that an independent repair shop may do better, then where is the unacceptable risk independent third parties pose? I would argue if third parties may do better, then for third parties to present unacceptable risk Apple must also present unacceptable risk.

[yetanotheraoc]

Re: Details

We don't have the data needed to decide whether, as Apple claims, the risk is unacceptable. Let's plug some numbers into the equation and see what we would need to know before deciding. Suppose the sum of Apple's certification efforts is lip-service beforehand and cover-up afterwards. By inspection the average independent shop will do better than that. Suppose on the other hand Apple is making a sincere, well-designed, and Herculean effort to keep out the miscreants. I don't think the average independent shop will do that much. But that effort metric is only half of the answer. The other half is, what would be the rate of privacy violations if nothing at all were done to stop them? It's my view that that background number is likely to be unacceptably high. The miscreants are out there, they don't all work for Apple or Apple's vendors, but clearly some of them do.

Imagine Apple is turning out "privacy" widgets on an assembly line. A few isolated but dramatic failures is not nearly enough to critique their QA department. They need to do better, but at the same time they may *already* be doing better than any hypothetical competitor. Of course they would say that, but just because it appears self-serving doesn't automatically make it false.

[big_D]

Re: Details

Have you ever watched Lous' channel?

Apple repair centres often "throw out" hardware as irreparable and tell the customer they need a new iThing.

The customer then takes the hardware to an unauthorised repairer and they find that a 50c resistor has blown and can be fixed in 10 minutes, while the customer waits. That is a huge problem for Apple, there is no real money in repairing iThings, especially if someone else is making the money on the repairs, the real money on repairs is made by telling the customer the old device is dead and they need a new one.

Apple tries many ways to stop this happening and one of those methods is claiming that your privacy is sacrosanct with Apple & its partners, and not with unauthorised repairers; which this case proves is complete and utter Blödsinn (German for nonsense, but literally, stupid sense).

[Falmari]

Re: Details

@yetanotheraoc “We don't have the data needed to decide whether, as Apple claims, the risk is unacceptable.”

That is the point we don’t have the data. All we know after this case is that there is a risk even using Apple. Therefore, there is a level of risk that is acceptable and any risk above that is unacceptable. We don’t know what the acceptable level of risk is what level of risk is for Apple or independent repair shops.

BTW what is an average repair shop who decides? How many repair shops would Apple have to inspect to get a reliable figure? How would Apple be able to get access to inspect these repair shops?

I am sorry now we know there is a risk even with Apple repair, without values for acceptable risk, Apple repair risk, average risk for independents, how this average risk was calculated and the sample size, there is no validity to Apple’s statement.

So, I do believe this case has undermined Apple’s statement.

[yetanotheraoc]

Re: Details

"we don’t have the data ... there is no validity to Apple’s statement"

Well put. I agree with that.

[DevOpsTimothyC]

Re: Details

We don't have the data needed to decide

For many people there is sufficent data. This single story is sufficent data when Apple are busy making the arguement that 3rd party repairers are untrustworthy. It also explains why you are being down voted.

The additional pieces of data that this story shows is that Apple is trying to surpress / cover-up any similar incidents.

For Apple this is a cost of doing business, not a life altering event. The average independant shop would be put out of business if this sort of thing were to occur. That gives the owners and hence the staff VERY powerful zero tollarence incentives.

Imagine Apple is turning out "privacy" widgets on an assembly line. A few isolated but dramatic failures is not nearly enough to critique their QA department.

When those widgets make it out to the public and Apple are busy lobbying to prevent others from making widgets on the claim of the other widgets being inferior then anything above zero is unacceptible.

[doublelayer]

Re: Details

"Imagine Apple is turning out "privacy" widgets on an assembly line. A few isolated but dramatic failures is not nearly enough to critique their QA department. They need to do better, but at the same time they may *already* be doing better than any hypothetical competitor. Of course they would say that, but just because it appears self-serving doesn't automatically make it false."

This is missing the point. The problem is not that Apple has problems, everybody does and will, but that they're claiming superiority and using that unproven allegation as a measure to prevent third-party repair and regulation of their repairability.

You like analogies, right? Here's one for their argument. You work in a technology-related field, I assume. If you don't, assume for a moment you do. I do as well. I can be trusted to treat data with security in mind, but you're an unknown quantity who should not be trusted. Because I am better than you, you must not be permitted to work without my approval. By the way, my alleged superiority can't be proven by anyone because I refuse to give out any data, and I have a history of breaking clients' systems some of the time. You would definitely do worse; I should have a right to prevent you from working. That's what Apple's trying to do. This doesn't prove that they're worse than everyone else, but it does prove that their assurances are false and that their claim to decide whether repairers are approved is invalid.

[big_D]

Re: Details

But that is Apple's argument, Apple only let authorized repair centres do repairs, because they are trustworthy and your privacy is sacred to them. An unauthorized repair centre won't care for your privacy and will publish your intimate information online...

Oh, wait... It is the hypocrisy of Apple in this situation: Apple is trustworthy, independents aren't!

This case proves that their reasoning for not having independent repairers is false.

[MachDiamond]

Re: Details

"Apple only let authorized repair centres do repairs"

But but but, those repair centers have signed agreements that they'll be good little boys and girls forever and ever.

And those agreement aren't worth the electrons they are printed on because all the contract does is spell out liability and remedies should the contract be violated. It can't prevent those things from happening.

The only recourse for customers will be to stop buying iThingys from apple. Like that's going to happen. A local repair shop may take a fatal hit from one screwup and may be more likely to take better steps in keeping this sort of thing from happening that isn't just words on paper.

[Michael Wojcik]

Re: Details

The question isn't whether an independent shop would do better; it's whether Apple's claim that there's a compelling likelihood it would be worse holds water. A failure of Apple's privacy protections decreases that likelihood.

[MachDiamond]

Re: Details

"My point stands. Apple and vendor failed, but would an independent repair shop do better? Maybe yes, maybe no, it all comes down to details.'

My belief is the local repair shop would be better. Most are small so the owner is more likely to be on site keeping an eye on things. It's their reputation on the line. Apple is taking a sting, but a small trader would be shut after something like this. There are also lots of repairs, mostly screen replacements, that can be done while the customer waits or on the same day. It's going to be at least a week if a phone has to be sent in no matter what the problem is. The customer also knows exactly where their phone is (or should be) and is dealing directly with the company doing the repairs.

[gnasher729]

Re: Details

Since the repair was done by someone authorised by Apple, the victim received a nice amount of money. Anyone else she could have sued of course but the perp wouldn’t have been able to pay a tenth of what Apple paid.

[Joe W]

Re: Details

So it is better to have $(personal_data) being stolen by Apple than by others, because you get more money out from a lawsuit?

[Dinanziame]

Re: Details

Actually, yes. Yes, it is better. When choosing companies, I definitely take into account the reputation of the company, and that is not necessarily because I believe they will make less mistakes, but because they will try harder to maintain their reputation.

[Peter Gathercole]

Re: Details

The second question you need to ask is whether, if Apple or one of their Authorized Repairers refused to fix your iThing, which they seem to do on a depressingly regular basis if you can believe the independents, how much risk you would be prepared to take to actually have it fixed rather than thrown away, and possibly all the data on it lost.

If your judgement is "I would not take any risk", then great. All Hail Apple, and you will accept any gougiug gratefully. But currently, you have some choice.

But if Apple can get away with shutting out the independents for a completely bogus and false privacy reason that they cannot defend, which is one of their main arguments and which is undercut by this case, then neither you, nor the people who have less concerns will have that choice at all.

[MachDiamond]

Re: Details

"false privacy reason"

The other reason they cite is they don't want to provide schematic for trade secret reasons. That's total manure. When the Tesla Model 3 was released to the public, some of the first cars were taken to the port, put in containers and shipped to China for disassembly. Even Munro and Associates bought one to take apart. Those entities have all of the skill and machinery to completely reverse engineer competitor's products. In fact, there are companies that specialized in reverse engineering stuff for their customers. The average person is not going to get a service manual so they can build their own widget. It's far cheaper to buy the mass produced one and have a warranty thrown in (for a certain value of warranty).

[MachDiamond]

Re: Details

"not necessarily because I believe they will make less mistakes, but because they will try harder to maintain their reputation."

What? The opposite often happens. If Amazon decides you are being too much of a pain, you get banned. They don't care, it's too expensive for them to care and losing your business is no big deal. Many mega companies are the same way. They get to be too big to care because is hurts the bottom line to even try. Small companies and one location shops have to be on point or they're sunk. Even if they are the only corner shop in the village these days. If the keepers are miserable oxygen thieves, people might go in for 500ml of semi-skimmed in a pinch, but they do a bigger shop online or the next time they are someplace else. There was a market in my town that was nasty. I went in once when I moved to the area and never again. I would rather drive 20 minutes each way to the next town. There is a nicer market now, but it has very limited food selections (but lots of chinese tat), is often out of things for weeks and is a bit more expensive but clean. I do my big shop when I'm down the road in the bigger town that has a warehouse store and an Aldi. The problem is that if I don't need much, the petrol cost outweighs the savings and selection.

[Bertieboy]

How?

If you pass a switched off Apple device to a repairer (of any description) how does the repairer get access to your private data without the unlock code? I'm assuming they require the owner to supply it which in itself should be a very large flag as in most cases (new battery, screen etc. ) just switching on should be sufficient to validate the repair. Sorry if the question seems to be a silly one but I am genuinely interested whether these repairers routinely seek the unlock code.

[Filippo]

Re: How?

I guess it depends on the nature of the fault. Ability to switch on may not be sufficient to validate the repair.

[Brewster's Angle Grinder]

Re: How?

Aha, so the way to crack open a perp's phone is to, um, crack it open and then intercept it when they post it to the idiot bar.

[yetanotheraoc]

Re: How?

"just switching on should be sufficient to validate the repair"

Sounds useful, maybe someone could invent some kind of power-on self-test to validate the hardware. Yes, I know you know that. The problem is the average end user who turns in their machine to the Apple proxy doesn't know about it.

As for your real question, I bet the repairers seek the lock code *every time*.

Here at work some years back I took the new cyber-security training which explained to *never* give our password to *anyone*. The next time I called in a ticket for a software problem, the level two help-desk technician asked for my password! What to do? It's not my data, it's not my software, I called them, so F*** it, I gave it to him. Also as soon as the call ended I changed it. It's better now, they don't ask any more, which means if they ask again this time I will say no.

One of my Thunderbolt ports has failed and at some point I will take it in for repairs. At which time I can add one more data point to the how often question. If they ask for my password, they are getting a flat No. If they tell me they need it to test, I will tell them I'll test it when I pick it up. And if they don't agree, I'll keep using just the one port.

[gnasher729]

Re: How?

Some small problems that I had, I had to enter the unlock code myself.

[John Brown (no body)]

Re: How?

"I'm assuming they require the owner to supply it which in itself should be a very large flag as in most cases (new battery, screen etc. ) just switching on should be sufficient to validate the repair. Sorry if the question seems to be a silly one but I am genuinely interested whether these repairers routinely seek the unlock code."

One of the strings to the bow of the company I work for is being an Apple dealer/authorised repair centre. Yes, the users access codes are required. Replacing a broken screen and simply confirming it works by turning it on is no substitute for doing a full diag of the system to make sure nothing else broke at the same time. If they refuse (some do) the warranty repair will be completed if possible and returned "as is" if only limited further diags are possible. The vast majority of what we deal with is corporate though, so in most cases a device, Apple or otherwise is either returned with a clean OS image or the customers specified OS image. All firmware is updated by default where applicable and all the hardware is checked so it goes back "as new" (in terms of functionality, case scratches ain't our problem), no unreported faults left unfound and unfixed unless, as above, the customer refuses required access codes or passwords.

And no, the guys in the workshop don't really have time to go rooting around in customers data. Diagnose, fix, test, onto the next one. Anyone caught doing anything untoward with customer data would be marched out of the door. Some of our customers are the type you occasionally see in the press as having left unsecured data on trains, so that's the sort of data that would be on some of the kit we fix. That sort of contract customer is too lucrative to risk.

[steelpillow]

Apple's new repair policy

Apparently we are about to be told that third-party repair outfits are a great idea after all.

Not because they provide any greater or lesser security/privacy/integrity etc, but because you can't sue Apple for approving them.

(OK I made it up, but be honest, how long are we going to have to wait?)

[yetanotheraoc]

Re: Apple's new repair policy

"you can't sue Apple for approving them"

If that were true, Apple would have been using them long ago. Anything to make the lawsuits go away.... But it wouldn't work. Lawyerly logic always finds some blame for the deepest pockets in the neighborhood of the crime. Driving your Mercedes Benz down the street near the accident? You should have stopped! See you in court.

Apple are no saints. They get sued all the time, every day, multiple times per day. Some of which they brought on themselves by doing wrong, and some of which they brought on themselves by having deep pockets. Either way, their lawyers are very busy.

[Lorribot]

There is a simple fix to this, make it easy to remove the storage chips like you would an SD card, it woudl help if all your personal data was only stored on that card not sprayed around by apps all over the place, but a well written OS should be able to manage that (stop laughing), then if you have to send it off you just remove your personal data and just send the kit in for repair with your personal data and porno movies never leaving your possession.

Or you can encrypt you local drive on a MacOS device but who does that.

[doublelayer]

"Or you can encrypt you local drive on a MacOS device but who does that."

A lot of people, because it's now in the setup questions and opt out. And it's enabled on IOS as long as the device has a passcode, which the vast majority does. All of which doesn't help you if the repair people ask for the codes, which they do.

[MachDiamond]

"as the device has a passcode, which the vast majority does"

I've taken the other route and have no passcode. I also don't have anything on the phone that would be a big deal to disclose. I have phone numbers in the contacts marked "ICE" (In Case of Emergency) that many first responders and hospital staff know to look for. It also means that if I am incapacitated and somebody needs a way to call help, they can using my phone without any problems. I know many phones have the option to call emergency services without the passcode, some don't or make it hard to figure out when you are freaking out. If something happens while I'm out with friends, they can look at my phone and find the numbers to call my family members and other friends. I have a couple of water brothers that live near me with keys to my house. They know that if something happens to me to go to my house and make sure the cat has food, water and a clean litter box. They'll also make sure that the HVAC isn't set to something silly and the lights are off so I don't come home to a whopping big utilities bill.

[DS999]

I have no problem with the award

Apple is ultimately responsible, so they deserved to be sued. But there's no way Apple's contract with Pegatron doesn't make them liable for misconduct on the part of their employees, so Apple will be sending them the bill for the settlement and their lawyers.

If that invoice doesn't give Pegatron incentive to police their employees better, I don't know what would!

[Yet Another Anonymous coward]

Re: I have no problem with the award

If she had taken her phone to Honest Achmed's phone repair and used camel store - yes

But Apple make a big play about how only their authorized repair places are allowed to touch the holy iPhone because of "security" - so Apple are on the hook.

[Yet Another Anonymous coward]

Re: I have no problem with the award

sorry I missed the negative, I thought you meant Apple weren't responsible because they had a contract with the repairer

[Potemkine!]

Louis Rossmann accused Apple of hypocrisy

<sarcasm> Oh, that's gross </sarcasm>

Apple, hypocrite? No kidding

[Trigun]

Disgusting

Having this done to you has got to be deeply devastating - having your friends, family, work colleagues as well as strangers see you naked or in a sex video. How do you recover from that psychologically? How do you go out and face every person who you had on your facebook and *know* they have seen that material? On top of that, these arseh*les made it look like she posted them herself. What kind of utter sh*t do you have to be to think this is funny? I wouldn't do this to my worst enemy, let alone someone who has caused me no offense.

The victim deserves every penny she gets out of the companies, but I'd love to see her go after the people who actually posted the material.

As for anyone who says you shouldn't take such photos/videos: Yeah, a bit unwise, but sorry (not sorry) but that's not the point. Anyone who has access to private data who is an adult knows not to view or share such information, unless it's criminal in nature (and then with police only).

[andy 103]

"Apple believes everyone has a right to privacy"

I can't remember the exact wording but when you set up a new iPhone/Mac it has some statement along the lines of "Apple believes everyone has a right to privacy".

Which is correct, they do.

It seems some people are quick to blame others for storing *their* data of *their* choice on *their* own device. It doesn't matter if you think someone is stupid for storing nudes on their own phone - the bottom line is that's their own personal data and on their own device and there is absolutely no implied consent for other people to "have" it. They have a right to privacy and just because it's "technically" possible for the data to be shared or leaked doesn't mean that's acceptable. On balance of probability the victim didn't want that data to be shared publically and gave nobody the right to do that.

This also goes further. Some people seem very quick to blame others for what they consider to be weak security practices. Again, it doesn't give anybody else the right to take advantage of that, and the law should rightly take that into account - was there clear intent from a victim to have their data stolen? Of course in 99.9% of cases - no, absolutely not. Stop blaming people when you know damn well others have done them wrong.

[werdsmith]

Re: "Apple believes everyone has a right to privacy"

Of course nobody has the right to take advantage of week security. Goes without saying.

Nobody has the right to drive my car away if I leave the key in it. But I'm definitely not going to do it.

[andy 103]

Re: "Apple believes everyone has a right to privacy"

"Nobody has the right to drive my car away if I leave the key in it. But I'm definitely not going to do it."

That's exactly my point. You shouldn't do it, but even if you did, it doesn't mean all of a sudden you're in the wrong and the person who stole your car has done something acceptable because you indirectly gave them that opportunity. You didn't consent to your car being taken, and the thief taking it has committed a crime.

In the same way, somebody giving a technician their passcode or access to their device, doesn't mean that they have implied the technician can do whatever they want with that person's data. Giving them access doesn't mean you're in the wrong because - even by doing that - it doesn't imply they're ok to "do whatever they want".

[werdsmith]

Re: "Apple believes everyone has a right to privacy"

You are stating the obvious a bit there @andy 103 I'm not arguing against what you've done two paragaphs on. Nobody is suggesting that slack security is consent. It clear is still stealing in the eyes of the law and the rest of us (even if insurance companies would refuse to pay out).

The point I am making is that this is not an ideal world and these bastards are out there. There is no doubt where the fault and blame lies with the thief who steals the car. But it's still not wise to make it easy for them. Because we know there are thieves out there, there always has been and always will be.

[MachDiamond]

Re: "Apple believes everyone has a right to privacy"

"Nobody has the right to drive my car away if I leave the key in it. But I'm definitely not going to do it."

If you were in the habit of leaving the keys in your car and it was stolen, I'd be all over you for that even if you'd parked in a "secure" lot.

[Ordinary Donkey]

Why does it have to be either or?

Can't I just be smug that there are no nude photos of me, even from my summer job giving rides on Skegness beach, without having people assume that I think the perp in this story did nothing wrong?

[Anonymous Coward]

"multimillion-dollar settlement " blimey! Reckon it's too late to send in my own dodgy iPhone with a few nudey pics, and score a fat payout? Something tells me I wouldn't be the one receiving compensation for psychological damage...