Roman GłogulskiAirDrop is a powerful tool that played a significant role for activists and protesters during the A4 protests in China in 2022. Many people took to the streets to express their opposition to the government’s handling of the pandemic. The organizers realized that with so many iPhones in the crowd, they could use AirDrop to send protest materials to a large group of people without leaving a digital message trace.
However, Apple disrupted these plans. Amid the protests, Apple implemented strict restrictions on the use of AirDrop in China, particularly regarding messages received from people outside the user’s contact list. Apple never provided a clear answer as to why they took this action, but it is evident that the company did not want the file transfer system to play a role in geopolitical unrest.
Now there is another reason for concern related to the initial enthusiasm for AirDrop. On January 9th, a Beijing law firm announced that it is using a new method to identify individuals sending illegal content via AirDrop and has already identified several suspects.
As Johns Hopkins Crypto Researcher Matt Green explains, researchers found a way to bypass this vulnerability back in 2019, reported it to Apple, and published the results of their research two years later. Green emphasizes that there is a way to build a system that bypasses this vulnerability, but it is processor-intensive, and Apple has not implemented it. This means that the vulnerability remained open for many years and could have been exploited by local authorities. Apple typically prioritizes encryption – the iMessage architecture is practically a temple of privacy protection enthusiasts – so it raises questions as to why this vulnerability remained open for so long. However, ultimately, AirDrop is not as secure as iMessage, nor was it designed to resist this kind of police pressure.
Eric Liu, an editor at China Digital Times, shared remarkable insights into the exploitation of this AirDrop vulnerability. He described it as a symbolic victory for the Chinese authorities, but a victory nonetheless. “At that time, AirDrop was not used frequently during protests, as they were rare. However, it created resistance and instilled extreme fear among the authorities,” Liu told me. According to him, the new vulnerability “reinforces the doubts of dissatisfied individuals about their ability to express dissent… No place is safe.”
This vulnerability also has tangible implications for the delicate peace between Apple and the Chinese government. Last year, Apple achieved $72 billion in sales in China, and until recently, Chinese factories produced 90% of Apple’s products. This necessitated behind-the-scenes diplomacy on Tim Cook’s part, but as long as Apple remained tied to China and China continued its electronics export, it was worth it for both sides.
Now, both sides of this agreement are starting to crack. Throughout the past year, U.S. lawmakers have engaged in discussions with Apple regarding decoupling from China – sometimes as a warning about geopolitical trends, and other times as an open threat. Apple has largely adapted by promoting new Foxconn locations outside of China, especially in India and Vietnam.
While the Chinese government has generally objected to this trend of decoupling from China, there have also been acts of pressure targeting Apple. In September, the government banned its employees from using iPhones for official purposes as a response to U.S. bans on Huawei and ZTE.
The fact that the municipal authority publicly announced its exploitation of vulnerabilities in Apple’s systems is another sign of worsening relations. While not unprecedented – Apple has complicated relationships with U.S. law enforcement agencies – it is certainly uncomfortable for the company that the attack became publicly known. Worse still, it forces Apple into a position that they sought to avoid during the protests.
This sends an uncomfortable message to Cupertino: at some point, Beijing may no longer be interested in facilitating things for Apple.
