Apple Stores Users’ Call Data For Months

Sigh. Here we go again.

In a surprising revelation (that really should surprise exactly no one), a Russian forensic security firm found that Apple automatically stores its iPhone users’ call and iMessage data and for as long as four months.

Elcomsoft — which reached notoriety when a hacker used the company’s software to download compromising photos from celebrities’ iCloud accounts, an event dubbed “celebgate” — released the details of Apple’s call data storage on Thursday (Nov. 17).

The data Apple stores include phone numbers, dates and times, as well as the length of calls. This info is automatically sent to Apple when iCloud is enabled. Apple can give this data and encryption keys over to law enforcement at any time. Users are not notified if synced call logs are downloaded.

It was also found that Apple keeps considerable records of FaceTime metadata and has done so since at least the release of iOS 8.2 in early March 2015. This directly contradicts the statement written in Apple’s iOS security guide. Apple further retains metadata records that rely on its CallKit, including Skype, WhatsApp and Viber.

A company spokesperson for Apple is quoted as saying: “We offer call history syncing as a convenience to our customers so that they can return calls from any of their devices. Apple is deeply committed to safeguarding our customers’ data.”

Apple users’ device data is passcode-encrypted. Access to iCloud data, including backups, requires both a user’s Apple ID and password.

Apple further recommends all of its customers select strong passwords and use two-factor authentication. Though hackers can be thwarted by two-factor authentication, not every iPhone user utilizes this additional security feature. But the issue of password strength is essentially moot if and when law enforcement requests data logs.

CEO of Elcomsoft wrote in a company blog post about the best (and only) way for iPhone users to protect themselves against having their call data stored: “There is no way to hide your calls from government requests other than disabling iCloud Drive.”

Apple has yet to directly comment on Elcomsoft’s findings.