https://techcrunch.com/2024/12/20/why-apple-sends-spyware-victims-to-this-nonprofit-security-lab/ [tc-lockup] TechCrunch Desktop Logo [tc-lo] TechCrunch Mobile Logo * Latest * Startups * Venture * Apple * Security * AI * Apps * Events * Podcasts * Newsletters Sign In Search [ ]Submit * Site Search Toggle Mega Menu Toggle Topics Latest AI Amazon Apps Biotech & Health Climate Cloud Computing Commerce Crypto Enterprise EVs Fintech Fundraising Gadgets Gaming Google Government & Policy Hardware Instagram Layoffs Media & Entertainment Meta Microsoft Privacy Robotics Security Social Space Startups TikTok Transportation Venture More from TechCrunch Events Startup Battlefield StrictlyVC Newsletters Podcasts Videos Partner Content TechCrunch Brand Studio Crunchboard Contact Us Sign In an illustration of a blue Lockdown Mode icon on a red phone on a blue background featuring Apple logos with padlocks.Image Credits:Bryce Durbin / TechCrunch Security Apple sends spyware victims to this nonprofit security lab Lorenzo Franceschi-Bicchierai 6:13 AM PST * December 20, 2024 Before the elections, the cybersecurity team of U.S. vice president and then-presidential candidate Kamala Harris reached out to Apple asking for help, according to Forbes, after a tool that's designed to detect spyware on iPhones flagged anomalies on two devices belonging to campaign staffers. Apple declined to forensically analyze the phones, per Forbes. The company's response is no surprise to the digital defenders working with at-risk populations often targeted by spyware. In the last few years, Apple has been sending notifications to targets and victims of government spyware, alerting them that they may have been hacked, and directing them to get help. Crucially, Apple doesn't tell the targets to get in touch with its own security engineers, but with the nonprofit Access Now, which runs a digital helpline for people in civil society who suspect they have been targets of government spyware. "Apple detected that you are being targeted by a mercenary spyware attack that is trying to remotely compromise the iPhone associated with your Apple Account," reads a recent alert, which Access Now shared with TechCrunch. "This attack is likely targeting you specifically because of who you are or what you do. Although it's never possible to achieve absolute certainty when detecting such attacks, Apple has high confidence in this warning -- please take it seriously." While it may look like Apple is abdicating its responsibility to protect its users, cybersecurity experts who work with human rights defenders, journalists, and dissidents generally agree that Apple's approach in alerting victims to spyware attacks is the right one. Contact Us Do you have more information about government spyware and its makers? From a non-work device, you can contact Lorenzo Franceschi-Bicchierai securely on Signal at +1 917 257 1382, or via Telegram and Keybase @lorenzofb, or email. You also can contact TechCrunch via SecureDrop. "These notifications have been a game changer for spyware accountability research," said John Scott-Railton, a senior researcher at the Citizen Lab, a nonprofit that investigates spyware and is housed at the University of Toronto Munk School of Global Affairs & Public Policy. "When I look back over the past few years, I see so many of the most important cases that we know about -- Poland, Thailand, so many others -- began with an Apple notification," said Scott-Railton. For people who investigate spyware, Apple sharing spyware notifications with victims represented a turning point. Before the notifications, "We were just like in the dark, not knowing who to check," according to Access Now's legal counsel Natalia Krapiva. "I think it's one of the greatest things that's happened in the sphere of this kind of forensic investigations and hunting of sophisticated spyware," Krapiva told TechCrunch. Now, when someone or a group of people get a notification from Apple, they are warned that something potentially anomalous is happening with their device, that someone is targeting them, and that they need to get help. And Apple tells them exactly where to get it, according to Scott-Railton, who said Access Now's helpline is the right place to go because "the helpline is able to do good, systematic triage work and support." Krapiva said that the helpline is staffed by more than 30 people, supported by others who work in other departments of the nonprofit. So far in 2024, Krapiva said Access Now received 4,337 tickets through the helpline. Scott-Railton, Krapiva, and security expert Runa Sandvik, who runs her own digital security consultancy Granitt for at-risk people and has been protecting journalists for a decade, all agree Apple should stop short of investigating individual attacks after notifying the victims. "Big tech companies don't want to get into the business of doing forensics on people's devices or accounts," Sandvik told TechCrunch. "I think that should remain separate." Eva Galperin, the director of cybersecurity at the nonprofit Electronic Frontier Foundation, who has been investigating surveillance on the internet for more than a decade, said that Apple could still do more to combat spyware. "[Apple] could write more detailed reports and file more lawsuits. These are the things that take massive amounts of money NGOs don't have and telemetry NGOs don't have," Galperin told TechCrunch. In its official page about mercenary spyware, last updated in October, Apple says that since 2012 it has sent notifications to users in more than 150 countries. Apple spokesperson Nadine Haija told TechCrunch that the "vast majority of users will never be the victims of such attacks, we sympathize deeply with the small number of users who are, and we continue to work tirelessly to protect them," and reiterated that there are no known cases of mercenary spyware on Apple devices with Lockdown Mode. "Our security teams are constantly working to track mercenary spyware attackers, and we send threat notifications to inform and assist users who we believe were individually targeted." For anyone alerted by a notification, Apple tells those targets and victims of spyware to update their iOS software and all their apps. Apple also suggests the user switches on Lockdown Mode, an opt-in iOS security feature that has stopped spyware attacks in the past by limiting device features that are often exploited to plant spyware. Apple said last year that it is not aware of any successful spyware infection against someone who used Lockdown Mode. Scott-Railton called Lockdown Mode "a game changer in increasing the security of people's devices, especially people who are at risk." All the experts TechCrunch spoke with strongly recommend turning on Lockdown Mode if you think you may be a target, especially if you are a journalist, human rights defender, or dissident. And if you get a notification from Apple, take it very seriously. Topics Access Now, Apple, Citizen Lab, cybersecurity, infosec, iOS, iPhone, lockdown mode, NSO Group, privacy, Security, Spyware, surveillance Lorenzo Franceschi-Bicchierai Lorenzo Franceschi-Bicchierai Senior Reporter, Cybersecurity @lorenzofb Lorenzo Franceschi-Bicchierai is a Senior Writer at TechCrunch, where he covers hacking, cybersecurity, surveillance, and privacy. You can contact Lorenzo securely on Signal at +1 917 257 1382, on Keybase/ Telegram @lorenzofb, or via email at lorenzo@techcrunch.com. View Bio Most Popular * Electric aircraft startup Lilium ceases operations, 1,000 workers laid off + Kirsten Korosec * X jacks up Premium+ prices by 37.5%, hits some markets harder + Manish Singh * Sriram Krishnan named Trump's senior policy advisor for AI + Kyle Wiggers * Palantir and Anduril reportedly building a tech consortium to bid on defense contracts + Anthony Ha * Apple might be working on a smart doorbell + Anthony Ha * OpenAI's GPT-5 reportedly falling short of expectations + Anthony Ha * OpenAI announces new o3 models + Maxwell Zeff + Kyle Wiggers Newsletters See More Subscribe for the industry's biggest tech news TechCrunch Daily News Every weekday and Sunday, you can get the best of TechCrunch's coverage. TechCrunch AI TechCrunch's AI experts cover the latest news in the fast-moving field. TechCrunch Space Every Monday, gets you up to speed on the latest advances in aerospace. Startups Weekly Startups are the core of TechCrunch, so get our best coverage delivered weekly. No newsletters selected. [ ] Subscribe By submitting your email, you agree to our Terms and Privacy Notice. Related * Elon Musk onstage at 'Exploring the New Frontiers of Innovation. Fundraising Elon Musk's xAI lands $6B in new cash to fuel AI ambitions + Kyle Wiggers 55 mins ago * Nvidia, Jensen Huang, Run:ai Hardware Nvidia's CES 2025 keynote: How to watch + Brian Heater 3 hours ago * Lilium Transportation Electric aircraft startup Lilium ceases operations, 1,000 workers laid off + Kirsten Korosec 5 hours ago Latest in Security See More * [cybersecurity-data-sharing-2024-v2] Security The TechCrunch Cyber Glossary + Zack Whittaker + Lorenzo Franceschi-Bicchierai + Carly Page 9 hours ago * WhatsApp logo reflected on sunglasses and displayed on a phone screen. Security WhatsApp scores historic victory against NSO Group in long-running spyware hacking case + Carly Page 11 hours ago * [gettyimages-913147778] In Brief Apple might be working on a smart doorbell + Anthony Ha 1 day ago TechCrunch Logo * X * LinkedIn * Facebook * Instagram * youTube * Mastodon * Threads * Bluesky * TechCrunch * Staff * Contact Us * Advertise * Crunchboard Jobs * Site Map * Terms of Service * Privacy Policy * RSS Terms of Use * Privacy Placeholder 1 * Privacy Placeholder 2 * Privacy Placeholder 3 * Privacy Placeholder 4 * Code of Conduct * About Our Ads * OpenAI o3 model * Telegram * Palantir * Most Disruptive Startups * X Premium+ * Tech Layoffs * ChatGPT (c) 2024 Yahoo.