German politicians receive Apple spyware alerts; BSI says compromise is unconfirmed
Apple calls its threat alerts a high-confidence sign of targeting. The BSI still advises German recipients to assume their phones may be compromised.
Apple, the BSI and the German digital minister are answering three different questions about the same alert. Apple's general support page calls its threat notifications "high-confidence alerts that a user has been individually targeted by a mercenary spyware attack".
It adds that its work "can never achieve absolute certainty". It gives no information on what triggers an alert and does not attribute attacks.
Three questions about one alert
The BSI addresses a separate question: whether the alerts mean devices were compromised. Its advisory states: "Dem BSI ist nicht bekannt, ob diese Benachrichtigungen tatsächliche Kompromittierungen bedeuten oder lediglich auf Angriffsversuche hinweisen." In plain terms, the agency does not know if the alerts reflect real compromises or only attempts. It still tells recipients to assume the device may be compromised.
Digital Minister Karsten Wildberger also stressed uncertainty about the concrete nature of the alert. On ARD he called the concrete nature of the alert "rein spekulativ", purely speculative, and said it must be awaited, according to Heise. He added that it worries the government and that the BSI reacted "superschnell", very fast.
Who received it, and what the spyware can do
Since 29 October, several Bundestag members and "weitere Personen des öffentlichen Lebens", other public figures, have received Apple's notice. The BSI wrote to Bundestag members on 30 October. ARD and Tagesschau reported on 1 November that members of the federal government had also received the alerts. Wildberger confirmed it on air without giving details.
The BSI defines mercenary spyware as commercially developed, advanced software. It has often been used on behalf of state actors against individually chosen people. It can infect a phone without any action by the owner, for example through a prepared message that need not be opened.
The BSI says attackers on a compromised device can reach messages, including encrypted messengers, plus calls, contacts, calendar and location. They can also switch on the microphone and camera.
What the BSI advises
The BSI's advice depends on whether a forensic analysis is planned. Recipients should update the operating system at once unless a forensic analysis is intended. Lockdown Mode makes new attacks harder but, in the BSI's words, does not remove an existing infection.
Where the risk is high, the BSI suggests replacing the device together with accounts and phone number. People who received an Apple warning are asked to contact the BSI directly.
CTOL's view
CTOL infers that the three statements are consistent: each answers a different question. Apple's alert says someone was singled out, which its page says is likely because of who the person is or what they do. A forensic examination could show whether spyware reached a device. The BSI's advice to assume compromise is a precaution, not a finding.
A BSI statement confirming compromise on a notified device would be the first result to move beyond precaution. A positive case would show success on one phone. It would not show how many others were hit or who was behind it. Until then, the evidence supports caution. It does not establish a breach.