Despite Apple fighting to protect customer data in recent years, the company is reportedly storing the call history of iPhone users, uploading the records to the iCloud for as long as four months – unbeknownst to its loyal customers.
According to Russian digital forensics firm Elcomsoft, Apple's iPhone and other iOS devices automatically send customers' call histories to iCloud if the synching service is turned on. That data is apparently uploaded without the user knowing or receiving notification.
“You only need to have iCloud itself enabled” for the data to be sent, Elcomsoft CEO Vladimir Katalov told the Intercept.
The information sent to iCloud includes phone numbers, dates, times and call durations, as well as logs of missed and bypassed calls.
The data is stored on iCloud for up to four months, and stands to offer assistance to law enforcement officials who perhaps are unable to obtain information from a suspect's phone in another way, according to Katalov. US law enforcement agencies can obtain direct access to the logs with a court order, but still need a tool to unlock them.
In addition to traditional calls, audio and video calls which take place on FaceTime on iOS devices are also sent to iCloud.
Elcomsoft believes the synching of both types of calls goes back to at least the iOS 8.2 system, which Apple released in March 2015.
However, the storage of calls on iCloud doesn't end there. Even calls made within third-party applications such as Skype, WhatsApp, and Viber get sent to the server.
Apple has acknowledged that call logs are being sent to iCloud, stating that it is intentional.
“We offer call history syncing as a convenience to our customers so that they can return calls from any of their devices,” an Apple spokesperson told the Intercept, stressing that iCloud data including backups require a user's Apple ID and password.
“Apple recommends all customers select strong passwords and use two-factor authentication.”
There's no opt-out for call logs being sent to iCloud, unless a user disables synching completely, according to Katalov.
“You can only disable uploading/syncing notes, contacts, calendars, and web history, but the calls are always there,” he said,
However, if a user deletes a call record from their Apple device, it will then get deleted from iCloud during the next automatic synchronization.
The data appears to sometimes be synced to iCloud almost instantly, while other times it appears to take place a few hours after a call. Katalov said his company is still researching the issue.
Although the revelation may come as a shock to many, Katalov noted Apple isn't the only guilty party. Android phones and Windows 10 mobile devices do similar synching methods, he said.