House Democrats demand answers from Apple on Group FaceTime eavesdropping flaw

“Top House Democrats are demanding answers from Apple CEO Tim Cook after a bug in the company’s FaceTime program allowed users to listen in on other devices even if their call hadn’t been accepted,” Harper Neidig reports for The Hill.
“Rep. Frank Pallone Jr. (D-N.J.), the chairman of the House Energy and Commerce Committee, and Rep. Jan Schakowsky (D-Ill.), who leads the panel’s consumer protection subcommittee, wrote to Cook on Tuesday expressing concern about the vulnerability that Apple says it fixed last week,” Neidig reports. “‘As such, we are writing to better understand when Apple first learned of this security flaw, the extent to which the flaw has compromised consumers’ privacy, and whether there are other undisclosed bugs that currently exist and have not been addressed,’ the two Democrats wrote.”
Read more in the full article here.
MacDailyNews Note: Apple has only taken Group FaceTime offline and announced that a fix is coming this week.
The Representatives’ press release, verbatim:
Energy and Commerce Chairman Frank Pallone, Jr. (D-NJ) and Consumer Protection and Commerce Subcommittee Chairwoman Jan Schakowsky (D-IL) sent a letter to Apple CEO Tim Cook today requesting more information about when the company first learned of the security flaw in its Group FaceTime feature, the extent to which the flaw has compromised consumers’ privacy and whether there are other undisclosed bugs that currently exist and have not been addressed.
Pallone and Schakowsky are particularly concerned with the privacy implications of the Group FaceTime bug in a world where smartphones and smart home devices, equipped with cameras and microphones, are used by nearly every adult and many children.
“While these are wonderful tools when used right, the serious privacy issue with Group FaceTime demonstrates how these devices can also become the ultimate spying machines. That is why it is critical that companies like Apple are held to the highest standards,” Pallone and Schakowsky wrote to Cook. “Your company and others must proactively ensure devices and applications protect consumer privacy, immediately act when a vulnerability is identified, and address any harm caused when you fail to meet your obligations to consumers.”
Pallone and Schakowsky are also troubled by how long it took for Apple to address the significant privacy violation, which was apparently identified by Grant Thompson, a 14-year-old boy. The bug allowed users to access a person’s iPhone camera and speaker before they even picked up the Group FaceTime call.
“As a first step, we believe it is important for Apple to be transparent about its investigation into the Group FaceTime vulnerability and the steps it is taking to protect consumers’ privacy,” Pallone and Schakowsky continued. “To date, we do not believe Apple has been as transparent as this serious issue requires.”
The Committee Chairs requested written responses to a series of questions by no later than February 19, 2019, including:
• When did your company first identify the Group FaceTime vulnerability that enabled individuals to access the camera and microphone of devices before accepting a FaceTime call?
Did your company identify the vulnerability before being notified by Mr. Thompson’s mother? Did any other customer notify Apple of the vulnerability?
• Please provide a timeline of exactly what steps were taken and when they were taken to address the vulnerability after it was initially identified.
• What steps are being taken to identify which FaceTime users’ privacy interests were violated using the vulnerability? Does Apple intend to notify and compensate those consumers for the violation? When will Apple provide notification to affected consumers?
• Are there other vulnerabilities in Apple devices and applications that currently or potentially could result in unauthorized access to microphones and/or cameras?
The letter is available HERE.
SEE ALSO:
Apple likely to pay reward to 14-year-old boy who found Group FaceTime eavesdropping bug – February 4, 2019
Apple’s iOS 12.1.4 is coming to fix the worst iPhone and iPad bug to date – February 2, 2019
Apple apologizes for Group FaceTime eavesdropping bug; will issue fix and re-enable feature next week – February 1, 2019
Canadian law firm applies for class action lawsuit against Apple over FaceTime eavesdropping bug – January 31, 2019
New York state begins probe into Apple’s slow response to FaceTime eavesdropping flaw – January 30, 2019
Apple sued over FaceTime bug that lets people eavesdrop – January 30, 2019
Apple was alerted about FaceTime eavesdropping bug days ago, did nothing – January 29, 2019
Apple, champion of ‘privacy,’ utterly blows it with massively stupid FaceTime bug – January 29, 2019
Apple to patch audio bug in FaceTime that allows users to hear audio and see video from users who have not yet accepted a call – January 29, 2019
Open letter to Tim Cook: Apple needs to do better – January 5, 2015