damonf

Xed said:

So this guy had ADP enabled but probably also used a PIN instead of a complex passcode for his device?

Personally, I waited a long time before enabling ADP because of the very clear warnings Apple gives before enabling it.

AppleInsider said:

While under ADP the Recovery Key is needed, the suit insists that Apple is still capable of doing something about the situation. Mathews' lawyer K. Jon Breyer says it is "indefensible" for Apple to hold onto the data "they don't own."

We'd hate to do that so we'll go ahead and delete that encrypted file off our servers by deleting your iCloud account. Happy?

Whereas I disagree with the suit that Apple can do anything after the fact for this user, it is rather dumb that ADP exists to protect iCloud data tied to an Apple Account (formerly Apple ID), yet in the enabling/disabling process for ADP there is never a prompt from the Settings app to enter one's Apple Account password to proceed.  All it takes is snatching someone's unlocked iPhone out of their hands and running off and quickly enabling ADP.  The ability to enable it without so much as having to enter one's Apple Account password despite the fact that it can lock one out of iCloud data is preposterous.  It is too easy to enable and needs some additional safeguards to prevent abuse.

How about a U.S. law:

Any U.S. based company instructed by any foreign country to decrypt data of Americans or required to disable decryption of American citizens’ devices (such as computers, phones, or tablets) must immediately cease all operations - including but not limited to sales, support, and services - in said country until such order is rescinded by said country.

The intent not being to hurt the company being asked (Apple, in this case), but to preempt such attempts with a harsh, effective punishment to the offending country.