Apple busts iOS 17 leaker with spycraft ‘canary trap’

> Having failed to identify who leaked the information regarding "Asteroid", Apple requested the subpoenas in an effort to find the culprit.

In that case, they used the courts to compel publishers to divulge their source. In this case, Apple’s own methods of planting a false flag among their employees caught the source. This is what the author was referring to.

In one example for the iPad, Business Insider reported that the device was chained to the desk and photos of the desk’s wood grain were taken to simplify singling out any leaked photos. Obviously they could refer to the wood grain later, with so few prototypes, preshooting photos isn’t needed - however it’s about conveying the message.

A lot of this stuff is theatre to telegraph to staff that they risk the weight of the NDA.

Good times.

I'm not surprised that Apple can't contain supplier leaks, they produce these things on such a high scale that tight teams are not an option in production.

However I expect better from Apple when it comes to software leaks as they can have the employees close to themselves.

I definitely dig the leaks but it's much more satisfying to be surprised by a proper presentation. I remember the iPhone 4 situation where the whole device leaked and I was reluctant to believe that this is Apple design because of the poor presentation bu by the tech journalists. Later, after proper introduction and using the device, it become my favourite iPhone design ever. Proper introductions are important, I wish Apple Keynotes weren't spoiled as much.

It's not a black and white leak vs no leak situation - there are very clearly degrees of severity at play here.

To use a recent example, sure we all know Apple is working on a VR headset, but there have been (to best of my knowledge) no meaningful leaks of images of the actual hardware or software; these will be a surprise on launch day, and surprises can be news worthy - helpful when trying to sell new things, or slow down the rate at which competitors build imitations.

I worked Apple retail, and I've worked in medical, legal and telecom. No other work place was as absolutely hard line about privacy and protecting information as the Apple environment was. And that permeated all parts of the workplace, from Apple's data to customer data. I will never forget how many things were just "fine" to do in the medical places I worked that would have been at a minimum a documentable offense at Apple. Obviously any culture thing is only as good as the people managing your local culture, but even if it never protected another product feature, maintaining that vigilance against leaking data is probably a good overall stance for such a huge tech company.

Although if I were them, I'd be worried most about my sister. Putting your own career on the line for internet fame is one thing; risking someone's else's is some deeply bad shit.

It feels like a cautionary tale for would-be leakers inside of Apple.

A possibility: analyst941 and the Apple employee are the same person. They leaked for whatever reason. After they were caught/fired, they fabricated this story about analyst941 actually being the sibling (with a real sibling's blessing). The sibling will not be in any trouble, because they didn't sign a confidentiality agreement - so it seems a loving sibling might sign on to play this role.

The ex-employee could face a lawsuit, and the lawsuit will look much better for the ex-employee if they merely told a sibling all these things(who then had loose lips), vs if the ex-employee specifically went to MacRumors message board to leak the info to the general public.

In some jurisdictions (including mine, but I do not know California law) there is the civil tort of Tortious Interference, where Parties A & B have a contract, and Party C improperly pushes/induces B to break their contract with A. A could then have a claim against C. What counts is specific, some sort of financial carrot/stick commonly. The former is obvious, for the latter a classic/textbook example would be if you have a contract to sell 500 foobars to A. Meanwhile C is planning to start selling foobars too, and also has lots of existing business with A that is very valuable to A. So C threatens A, saying they'll stop doing business with them unless they breach their contract with you. There is no explicit bribing or payment there, merely denial of future payment, but that could still be a case for tortious interference.

But it's very possible that there's nothing here actionable (or the tort may not be there in CA), and this is just someone using a very generous "might take legal action". If this goes to court Apple would do discovery and check I assume, but it'd be fact dependent.

Edit: sibling comments mention there is also some specific CA law regarding trade secrets.

For groups like Wikileaks, it helps that US government documents and laws, with limited exceptions, are not copyrighted or copyrightable in the US. So when they report a huge NSA scandal and publish those documents, the government can't claim copyright infringement... but they will tear the place apart to find the leaker. And of course, spy on the reporter extremely closely for any possible legal slip-up no matter how small (or, arguably, if they hate the reporter enough, make something up).

Folks below were also discussing criminal, which strikes me as unlikely but not at all impossible.

(Can you tell I'm a non-practicing lawyer?)

> California Trade Secrets Act (2022) sections 3426 to 3426.11 of the California Civil Code

> (a) "Improper means" includes theft, bribery, misrepresentation, breach or inducement of a breach of a duty to maintain secrecy, or espionage through electronic or other means. Reverse engineering or independent derivation alone shall not be considered improper means.

> (b) "Misappropriation" means:

> (1) Acquisition of a trade secret of another by a person who knows or has reason to know that the trade secret was acquired by improper means; or(2) Disclosure or use of a trade secret of another without express or implied consent by a person who A) Used improper means to acquire knowledge of the trade secret; or(B) At the time of disclosure or use, knew or had reason to know that his or her knowledge of the trade secret was i) Derived from or through a person who had utilized improper means to acquire it;(ii) Acquired under circumstances giving rise to a duty to maintain its secrecy or limit its use; or(iii) Derived from or through a person who owed a duty to the person seeking relief to maintain its secrecy or limit its use; or(C) Before a material change of his or her position, knew or had reason to know that it was a trade secret and that knowledge of it had been acquired by accident or mistake.

It sounds to me like that would incriminate the tipster as well, if the leaked information counts as a trade secret at least, regardless of whether the former employee knew about it or not.

[1] https://forums.macrumors.com/threads/farewell-message.238918...

I don't know if this changes the legal situation any, but it has certainly already (assuming the tipster is honest) led to negative consequences for them: their sister lost her job because of them, and is now no longer speaking to them.

> Apple also requires its employees to sign nondisclosure agreements, which forbid the signees from discussing secret projects with unauthorized people. That includes other Apple employees — and most certainly anyone outside the company.