A recording of an internal briefing at Apple earlier this month obtained by The Outline sheds new light on how far the most valuable company in the world will go to prevent leaks about new products.
The briefing, titled “Stopping Leakers - Keeping Confidential at Apple,” was led by Director of Global Security David Rice, Director of Worldwide Investigations Lee Freedman, and Jenny Hubbert, who works on the Global Security communications and training team.
According to the hour-long presentation, Apple’s Global Security team employs an undisclosed number of investigators around the world to prevent information from reaching competitors, counterfeiters, and the press, as well as hunt down the source when leaks do occur. Some of these investigators have previously worked at U.S. intelligence agencies like the National Security Agency (NSA), law enforcement agencies like the FBI and the U.S. Secret Service, and in the U.S. military.
The briefing, which offers a revealing window into the company’s obsession with secrecy, was the first of many Apple is planning to host for employees. In it, Rice and Freedman speak candidly about Apple’s efforts to prevent leaks, discuss how previous leakers got caught, and take questions from the approximately 100 attendees.
The presentation starts and ends with videos, spliced with shots of Tim Cook presenting a new product at one of Apple’s keynotes, that stress the primacy of secrecy at Apple. “When I see a leak in the press, for me, it’s gut-wrenching,” an Apple employee says in the first video. “It really makes me sick to my stomach.” Another employee adds, “When you leak this information, you’re letting all of us down. It’s our company, the reputation of the company, the hard work of the different teams that work on this stuff.”
“I have faith deep in my soul that if we hire smart people ... ultimately they’re gonna do the right thing, and that’s to keep their mouth shut.”
Steve Jobs ran a notoriously secretive ship during his tenure as Apple’s CEO, and in 2004 the company even unsuccessfully tried to subpoena a group of tech bloggers to unmask their sources. Cook first publicly mentioned doubling down on secrecy at a 2012 tech conference, and this presentation seems intended to reveal the results of that effort.
“This has become a big deal for Tim,” Greg Joswiak, Apple’s Vice President of iPod, iPhone and iOS product marketing, says in one of the videos. “Matter of fact, it should be important to literally everybody at Apple that we can't tolerate this any longer.” Later, Joswiak adds that “I have faith deep in my soul that if we hire smart people they’re gonna think about this, they’re gonna understand this, and ultimately they’re gonna do the right thing, and that’s to keep their mouth shut.”
To make sure of it, Apple has built an infrastructure and a team “to come after these leakers,” Joswiak says, and “they're being quite effective.”
After the first video concludes, Hubbert addresses the room. “So you heard Tim say, ‘We have one more thing.’ So what is that one more thing?” she asks. “Surprise and delight. Surprise and delight when we announce a product to the world that hasn’t leaked. It’s incredibly impactful, in a really positive way. It’s our DNA. It’s our brand. But when leaks get out, that’s even more impactful. It’s a direct hit to all of us.”
“So today we’re going to share with you some of the behind the scenes of leaks that have happened on the supply chain, but also, right here in Cupertino,” she says. “So let’s paint a picture as to this team that Tim said we’d put in place.”
She then introduces David Rice to talk about the “New Product Security” team, a part of the larger Global Security team that Rice says “is really a secrecy group, we’re a little bit misnamed.” Rice worked at the NSA as a Global Network Vulnerability Analyst for four years, and before that was a Special Duty Cryptologist in the U.S. Navy. He’s directed the Global Security team at Apple for more than six years, according to his LinkedIn page. Hubbert also introduces Lee Freedman, who previously worked as the Chief of Computer Hacking Crimes at the U.S. Attorney’s Office and as an Assistant U.S. Attorney in Brooklyn, according to LinkedIn. He joined Apple to lead Worldwide Investigations in 2011.
The New Product Security team is “very heavily on supply chain,” Hubbert says, and that’s the focus of the first part of the presentation.
Historically, Apple’s biggest leaks happened when parts were stolen from factories in China. Those parts get shared with the press, like when photos of the iPhone 5 leaked in 2012, or sold on the black market.
However, Rice says, Apple has cracked down on leaks from its factories so successfully that more breaches are now happening on Apple’s campuses in California than its factories abroad. “Last year was the first year that Apple [campuses] leaked more than the supply chain,” Rice tells the room. “More stuff came out of Apple [campuses] last year than all of our supply chain combined.”
Rice compares Apple’s work of screening factory employees to that of the TSA. “Their peak volume is 1.8 million a day. Ours, for just 40 factories in China, is 2.7 million a day.” That number surges to 3 million when Apple ramps up production, he adds, and all of these people need to be checked every time they enter and exit the factory.
“In aggregate, we do about 221 million transits a year. For comparison, 223 million is the top level volume for the top 25 theme parks in the world,” Rice says. “So this is just one big theme park. People coming in, coming out, there's billions of parts flying around at any given instance. So you marry up a bunch of parts moving around plus a lot of people moving around and it's no wonder that we don't leak even more.”
The Global Security team in China has been “busting their ass” to solve the problem of leaks stemming from Apple’s factories, Rice says, describing the efforts as “trench warfare non-stop.”
“We deal with very talented adversaries,” he says. “They're very creative and so as good as we get on our security controls, they get just as clever.” Black market sellers solicit factory workers by posting signs at bus stops and factory dormitories, he says, offering “top dollar” for Apple parts.
Apple’s Chinese workers have plenty of incentive to leak or smuggle parts. “A lot, like 99.9 percent, of these folks are good people who are coming to a place that has a job, they're gonna make money, and they're gonna go back and start a business in their province or they're gonna do something else with it, support their family,” Rice says. “But there’s a whole slew of folks that can be tempted because what happens if I offer you, say, three months’ salary?’ In some cases we’ve seen up to a year’s worth of salary being rewarded for stealing product out of the factory.” Apple workers on the production line make approximately $350 a month, not including overtime, according to a 2016 report from China Labor Watch.
The most valuable part for a thief is the housing or enclosure, which is basically the metal back of an iPhone or MacBook. “If you have a housing, you pretty much know what we're going to ship,” Rice says.
Workers will stash parts in bathrooms, clench them between their toes, throw them over fences, and flush them down the toilet for retrieval in the sewer, Rice says. “We had 8,000 enclosures stolen a long time ago by women putting it in the underwire of their bra,” he says. “They're going to great lengths to steal this stuff. But it's not just enclosures. It's also anything that reveals product prior to announce.”
The stolen parts often end up in Huaqiangbei, one of the biggest electronics markets in the world, located in Shenzhen, Southern China. This market employs about a half million people and does about $20 billion a year in revenue, Rice says. One “particularly painful year” was 2013, when Apple had to buy back about 19,000 enclosures before the iPhone 5C announcement, he recalls, and then an additional 11,000 before the phones were shipped to customers. “So we're buying as fast as we possibly can to try to keep it out of every blog on Earth,” Rice says.
William Turton and Adrianne Jeffries discussed this story, with additional details, on our daily podcast, The Outline World Dispatch.
In the years since Tim Cook pledged to double down on secrecy, Rice��s team has gotten better at safeguarding enclosures. “In 2014 we had 387 enclosures stolen,” he says. “In 2015 we had 57 enclosures stolen, 50 of which were stolen on the night of announce, which was so painful.” In 2016, Rice says the company produced 65 million housings, and only four were stolen. “So it's about a one in 16 million loss ratio, which is unheard of in the industry.”
Later, during the employee Q&A, Rice gleefully recounts a blog post written by longtime Apple watcher John Gruber, in which Gruber criticized Apple scoop machine Mark Gurman, who now works at Bloomberg, for not having juicy details on Apple’s new HomePod speaker before it was released. “Even [Gruber] was like ‘Yeah, you got nothing.’ So he was actually throwing some shade out, which, like, ‘all riiight,’” Rice says, to the laughter of employees.
The presentation shifts away from China to focus on leaks coming from Apple’s campuses in the U.S. In the past, Apple’s U.S. employees have griped about draconian security measures, Rice says, because of the leakiness of the supply chain. “You always get this battle ... like, ‘Well, why do we have to do all this security stuff when our supply chain leaks so much?’” Rice says. “I think the noise has always been high here and once the supply chain noise dropped down suddenly we realized, ‘Oh crap. We have a problem here.’”
Apple embeds members of a team within Global Security, called Secrecy Program Management, on some product teams to help employees keep secrets, he explains. But when sensitive information does get out, Lee Freedman’s investigations team steps in to figure out what happened and who is responsible.
One investigation that led to a leaker on an Apple campus took three years.
“These investigations go on a long time,” Freedman tells the employees. For example, one investigation that led to a leaker on an Apple campus took three years. “We don't take a defeatist mentality and say, ‘Oh well, it's going to leak anyways.’ For us, it's not, ‘Oh well, it just keeps showing up in the blogs and we have to live with it.’”
Hubbert prompts him to talk about two major leakers who were caught the previous year, one who worked at Apple’s online store “for a couple years” and one who worked on iTunes for “about six years.”
Both these leakers were “providing information to bloggers,” Rice says. One of the leakers started talking to a journalist over Twitter, Freedman says, while the other had a preexisting friendship with a reporter.
“So can you paint a picture of the characteristic[s] of the leakers?” Hubbert asks. “I mean, is there a common thread to what they do?”
“The common thread is they look just like you guys,” Freedman says to the assembled employees. “They come to work, they don't appear any different, and they start off with the exact same motivation about ‘I love Apple, I think this is a cool place to work, I wanna make it better.’”
In the past, Apple has seen disgruntled employees leak after a bad performance review, he says. “But that's oftentime not what happens. We oftentimes get people who are really excited about our products and they end up finding something to share and they will go out and say, ‘Hey, guess what we did,’” he says. “Or somebody will ask them a question and instead of just saying, ‘I can't talk about it,’ they will say too much.”
Rice says that Apple’s focus on secrecy has not translated to a culture of fear. “I think what is unique at Apple is that we don’t have a Big Brother culture,” Rice says. “There’s nobody on my team reading emails, sitting behind you on the bus, we don’t do that.”
But the presentation makes working for Apple sound like working for the CIA. (At one point, Rice even refers to “blowing cover.”) There are repeated references to employees drawing boundaries in their personal lives, for example. “I go through a lot of trouble not to talk about what I work on with my wife, with my teenage kids… with my friends, my family,” an employee in one of the videos says. “I’m not telling you that you give up all relationships,” Rice says, “but that you have a built-in relationship monitor that you’re constantly using.”
“I go through a lot of trouble not to talk about what I work on with my wife, with my teenage kids… with my friends, my family.”
“Active solicitation” is just one part of secrecy at Apple, Rice says; there is also the risk of passively mentioning something. Apple employees are expected to be discreet in their own office. The hallway and the Apple lobby are referred to as “red zones,” which “aren’t places to talk,” Rice says. The fear of accidentally “breaking secrecy” may be why some newly hired Apple employees tend to delete their Twitter accounts. Jonathan Zdziarski, a high profile security researcher, locked down his Twitter account after being hired by Apple.
“The sense we get when we talk to Apple engineers across the board is like, ‘Well gosh, what if I say something in a park? Did I just break secrecy?’” Rice clarifies that the internal myth that anything not on Apple.com is confidential isn’t true. Employees are free to share some things with outsiders, he says, like how “crappy [their] boss is” or their salary information, and they’re free to talk to law enforcement “if the company is doing something illegal.” The hard lines, he says, are around unreleased products, unreleased services, or availability of products, which Apple expects employees not to talk about with anyone who hasn’t been “disclosed.”
Rice urges employees to come forward if they are worried about having “broken secrecy.” Nine times out of 10, when people get in trouble at Apple, he says, it’s because they tried to cover up a mistake.
“Our role at NPS was created because someone spent three weeks not telling us a prototype was in a bar somewhere,” Rice says in the briefing, referring to the prototype iPhone 4 left in a bar by an Apple employee that made its way to Gizmodo in 2010. That leak was so devastating to Apple that Steve Jobs personally called the editor of Gizmodo to ask for the phone back. “The crime was in the coverup.”
Other tech companies have begun to follow Apple’s lead on instilling a culture of secrecy. According to a 2016 report from Business Insider, Snapchat CEO Evan Spiegel has a portrait of Steve Jobs hanging in his office, and the company has cultivated an obsession with leaks similar to Apple’s. Facebook is currently hiring a “Global Threat Investigations Manager,” and Google is facing a lawsuit in San Francisco alleging that the company operates an internal “spying program.”
Some of the hypothetical and real leaks discussed in the briefing seem inconsequential: the release of watch bands, or the fact that a new iPad will be “bigger,” for example. But Cook believes leaks directly hurt Apple’s bottom line. During the company’s most recent earnings call, Cook blamed flagging iPhone sales on “earlier and much more frequent reports about future iPhones.” Indeed, there have been a slew of leaks about the iPhone 8, scheduled to be announced in the fall. “Apple has a major iPhone redesign planned for 2017, with a glass body and edge-to-edge OLED display that includes an integrated Touch ID fingerprint sensor and front-facing camera,” according to MacRumors.
Such leaks may be why Apple is now hosting these internal secrecy briefings. Rice says he expects all employees to live and work within the “Adult Zone,” which essentially means to use discretion. “When I call it the Adult Zone, I really mean that,” he says. “One thing you have to recognize — I hope you recognize — is that Apple gives you an extraordinary amount of power.”
Contact the author at william@theoutline.com.
