Apple, CALEA, and Law Enforcement
Nick contends this is a serious weakness in iMessage; I agree. This problem can arise in iMessage because of the way the iMessage protocol has been set up. Neither the sender nor the receiver has a way of knowing if any others are in the communications path because Apple provides no way for Alice or Bob to check. Other end-to-end encrypted systems have been designed to prevent this problem. WhatsApp or Signal, for example, both provide users a way to check if there is a man in the middle (see here and here respectively). This is a security weakness of the iMessage protocol and should be fixed.
[…]
There’s another way that Alice and Bob’s encrypted communication can be eavesdropped upon. Because iMessage allows multiple devices on a single account, Apple could add the FBI as a second “virtual device” to Bob’s account.
[…]
If Apple was to change its technology to be able to surreptitiously add a device to the account—that’s the way the wiretapping would work—it would have to deactivate the warning system. (Otherwise the bad guy would know he’s being tapped.)
The real question is not whether Apple can do this. (The answer is yes.) The real answer is whether Apple can do this in a way that doesn’t disrupt the system for everyone else and destroy their security. That’s far from clear.
