Michael Mathews, a corporate executive living in Minnesota, was on a Christmas holiday in Arizona in December 2023. During the trip, his iPhone was stolen. Those who stole the iPhone used the Apple ID to access and acquire his Apple account information, which contained highly sensitive financial information.
After failing to recover his data, Mathews filed a lawsuit against Apple in 2024 for US$5 million. From a standpoint of legitimate transparency, this incident highlights the loopholes in Apple's data protection system.
Apple's Advanced Data Protection (ADP) provides encryption for the user's data, using keys controlled by the user. The objective is to provide users with better privacy; however, if user access is lost, ADP does not allow for any recovery of the data. In the case of Mathews, the ADP policy locked him out of his iCloud data, which was subsequently resolved by recovering the stolen iPhone. Even a recovery key, intended to allow users to retrieve their accounts, was excluded from Mathews's stolen iPhone.
The lawsuit is likely to raise issues regarding the tension between higher privacy levels and accessibility. The situation of Mathews raises awareness regarding the ADP as a means to improve security; however, it makes it more difficult for users to recover data in emergencies. Mathews claims that Apple didn't allow him to access or retrieve the vital information he needed.
After Mathews filed the lawsuit, Apple eventually implemented a feature called Stolen Device Protection later in the iOS update. The Stolen Device Protection feature was designed to uniquely enhance protection for iPhone users who lost or had their phones stolen; however, the actual benefits and features of the Stolen Device Protection in real-world situations are unknown.
This case highlights the delicate balance between protecting users and maintaining usability. While strong encryption is warranted, it could restrict the user's ability to access their information. The outcome of that very case reshaped Apple's other processes regarding security, no matter the motives.