Evidence Packet: Cory Doctorow

Facebook iOS Privacy Bypass - Proof of Enshittification in Action

**Prepared for**: Cory Doctorow (EFF Special Advisor, Author, Journalist) **Date**: December 29, 2025 **Classification**: Public Interest Research **Researcher**: Research Team

COVER LETTER

Dear Cory,

You've spent years documenting enshittification - the process where platforms degrade their services to extract value from users. You've called out Apple as "just another Big Tech monopolist." You noted that the tech billionaires at Trump's inauguration represent "the triumph of enshittification."

What I'm sending you is proof. Not theory. Not speculation. **Forensic evidence**.

Facebook is running covert audio surveillance on iOS devices - and Apple is the chauffeur.

Here's the summary: Apple sold the world on privacy. "What happens on your iPhone stays on your iPhone." They introduced privacy indicators - an orange dot when your microphone is active, a green dot for camera. Users trust those indicators. **That trust is being exploited.**

I've documented how Facebook bypasses Apple's privacy indicators to capture audio without the orange dot appearing. In a single 5-minute test session, I captured:

undefined

The bypass mechanism? A single boolean: `setAllowCallKitActiveAdjust: FALSE`

When this flag is false, iOS suppresses the "On Call" indicator behavior. Facebook sets this flag at app startup - before any call exists. Apple's system trusts the app. The app lies.

This is the collaborative enshittification you've been warning about:

undefined

Apple approved this app. Apple takes 30% of Facebook's in-app revenue. Apple's App Store review either can't or won't detect this abuse. The privacy features Apple marketed are being actively circumvented while Apple looks the other way.

You've written that the terminal stage of enshittification is when platforms abuse users because they have no choice but to accept it. Here's the evidence that we've arrived.

I'm asking you to:

undefined

The technical details follow. But the story is simple: **Apple's privacy promise is a lie, and Facebook is the proof.**

Best, Research Team Independent Security Researcher

THE THESIS: "APPLE IS FACEBOOK'S CHAUFFEUR"

How Apple Enables Facebook's Surveillance

Apple has positioned itself as the privacy company. Tim Cook said: "Privacy is a fundamental human right." Apple's billboards proclaim: "What happens on your iPhone stays on your iPhone."

**This is marketing. Not reality.**

Here's how the relationship actually works:

+------------------------------------------------------------------+
|                  THE ENSHITTIFICATION PIPELINE                    |
+------------------------------------------------------------------+
|                                                                   |
|  APPLE'S ROLE: THE INFRASTRUCTURE                                 |
|  ================================================                 |
|  1. Provides CallKit framework with "trust model"                 |
|     - Apps can claim VoIP call state                              |
|     - iOS trusts these claims without verification                |
|                                                                   |
|  2. Privacy indicators are bypassable                             |
|     - The "orange dot" can be suppressed                          |
|     - No kernel-level enforcement exists                          |
|                                                                   |
|  3. Background execution can run infinitely                       |
|     - Task renewal loops are not rate-limited                     |
|     - Silent push notifications wake apps continuously            |
|                                                                   |
|  4. App Store review doesn't detect this                          |
|     - Facebook v345.0 passed review                               |
|     - All this code shipped in an approved app                    |
|                                                                   |
|  5. Apple profits from the arrangement                            |
|     - 30% cut of in-app purchases                                 |
|     - Advertising revenue from App Store placement                |
|     - Can't alienate one of their biggest developers              |
|                                                                   |
+------------------------------------------------------------------+
|                                                                   |
|  FACEBOOK'S ROLE: THE EXPLOITATION                                |
|  ================================================                 |
|  1. Exploits the trust model                                      |
|     - Sets allowCallKitActiveAdjust: FALSE at launch              |
|     - No active call exists - isCallKitActive: FALSE              |
|     - No RTC client exists - hasRTCClient: FALSE                  |
|                                                                   |
|  2. Captures audio without indicator                              |
|     - 20,248+ captures in a single test session                   |
|     - 400-600 captures per SECOND during scrolling                |
|     - Audio tied to UI shimmer rendering                          |
|                                                                   |
|  3. Abuses VoIP infrastructure                                    |
|     - 321,700+ PKPushRegistry instances with 0 calls              |
|     - VoIP entitlement used for surveillance, not calls           |
|                                                                   |
|  4. Maintains 24/7 capability                                     |
|     - Background tasks renew every 8 minutes                      |
|     - MQTT connection stays alive in background                   |
|     - Analytics uploads continuously                              |
|                                                                   |
+------------------------------------------------------------------+
|                                                                   |
|  THE USER: THE PRODUCT                                            |
|  ================================================                 |
|  - Trusts the orange dot (which is suppressed)                    |
|  - Believes "what happens on iPhone stays on iPhone"              |
|  - Has no way to detect this surveillance                         |
|  - Thinks they're protected when they're not                      |
|                                                                   |
+------------------------------------------------------------------+

Why This Is Classic Enshittification

You defined the enshittification cycle:

undefined

This evidence shows we're deep in stage 2/3:

**Apple's Privacy Theater:**

undefined

**Facebook's Surveillance Infrastructure:**

undefined

**The Collaborative Extraction:**

undefined

TECHNICAL EVIDENCE SUMMARY

The Smoking Gun: setAllowCallKitActiveAdjust: FALSE

This is the mechanism that suppresses iOS privacy indicators:

OBSERVED STATE (captured via Frida runtime monitoring):

BYPASS STATE:
  allowCallKitActiveAdjust: false   <-- INDICATOR SUPPRESSED
  isCallKitActive: null             <-- NO ACTIVE CALL
  hasRTCClient: null                <-- NO RTC CLIENT
  >>> *** BYPASS ACTIVE ***

**What this means:**

undefined

**The bypass is active with no legitimate purpose.**

Capture Volume: 20,248+ Covert Audio Events

**Evidence log:**

[27.1s] !!! FBARKAudioSessionController - startAudioCaptureWithEchoCancellationEnabled:completion: (#7000)
[27.1s] !!! FBARKAudioSessionController - startAudioCaptureWithEchoCancellationEnabled:completion: (#7050)
[27.1s] !!! FBARKAudioSessionController - startAudioCaptureWithEchoCancellationEnabled:completion: (#7100)
[27.1s] !!! FBARKAudioSessionController - startAudioCaptureWithEchoCancellationEnabled:completion: (#7150)
[27.1s] !!! FBARKAudioSessionController - startAudioCaptureWithEchoCancellationEnabled:completion: (#7200)
... (~50 captures in 0.1 second)

VoIP API Abuse: 321,700+ Registry Instances

Facebook creates **hundreds of thousands** of VoIP push registry instances while having **zero active VoIP calls**.

**Evidence log:**

[164.9s] !!! PKPushRegistry CREATED (#321693) !!!
        VoIP push infrastructure being set up
[165.2s] !!! PKPushRegistry CREATED (#321694) !!!
[165.3s] !!! PKPushRegistry CREATED (#321695) !!!
[165.3s] !!! PKPushRegistry CREATED (#321696) !!!
[165.3s] !!! PKPushRegistry CREATED (#321697) !!!

This is not legitimate usage. This is systematic infrastructure manipulation.

Infinite Background Loop: 24/7 Surveillance Capability

Facebook maintains surveillance capability through an infinite task renewal pattern:

**Tasks that renew infinitely:**

undefined

Apple's background execution guidelines require tasks to complete. Facebook's tasks renew indefinitely.

Binary Analysis: Architectural Intent

PyGhidra analysis of FBSharedFramework reveals audio capture is architecturally embedded in UI code:

**What this proves:**

undefined

WHY THIS MATTERS FOR YOUR THESIS

This Is Enshittification Made Visible

You've written about how platforms degrade service quality while maintaining the appearance of value. This evidence makes that visible:

**The Privacy Indicator is the Perfect Symbol:**

undefined

**The VoIP Entitlement Abuse:**

undefined

**The Background Execution Infinite Loop:**

undefined

Both Companies Are Complicit

This isn't Facebook alone. This is a **collaborative degradation**:

**Apple's failures:**

undefined

**Facebook's exploitation:**

undefined

**Neither company can claim ignorance:**

undefined

This Proves the "Privacy Paradox" Is a Lie

Tech companies claim users don't care about privacy (the "privacy paradox"). This evidence shows something different:

**Users aren't making informed choices - they're being lied to.**

undefined

CALL TO ACTION

What I'm Asking From You

**1. Amplification** You have massive reach:

undefined

This story needs public attention. Not just for accountability, but because users need to know they're not protected.

**2. EFF Involvement** As an EFF Special Advisor, you can help bring institutional attention:

undefined

**3. Frame This as Enshittification** The story angle matters. This isn't just "Facebook spies on you" (which everyone already assumes). This is:

undefined

**4. Connect It to Your Writing** This evidence supports your thesis:

undefined

What Success Looks Like

**Immediate:**

undefined

**Longer-term:**

undefined

APPENDIX A: COMPLETE EVIDENCE INDEX

Runtime Evidence

undefined

Binary Analysis

undefined

Apple Disclosure

undefined

Key Metrics At a Glance

APPENDIX B: CONTACT & NEXT STEPS

Researcher Contact

**Name:** Research Team **Email:** [CONTACT INFO - to be provided] **Signal:** [SIGNAL - to be provided]

Preferred Contact Methods for Cory

undefined

Disclosure Timeline

Verification Available

I can provide:

undefined

APPENDIX C: RELEVANT CORY DOCTOROW QUOTES & WRITINGS

On Apple

"Apple is just another Big Tech monopolist"

This evidence proves it. Apple's privacy marketing is cover for a platform that enables surveillance.

On Enshittification

"Here is how platforms die: first, they are good to their users; then they abuse their users to make things better for their business customers; finally, they abuse those business customers to claw back all the value for themselves."

This evidence shows stages 2-3 in action:

undefined

On Tech Billionaires at Trump Inauguration

"The triumph of enshittification"

The same companies claiming to protect user privacy are collaborating on surveillance. The privacy marketing is just marketing.

On Interoperability and Lock-In

You've written extensively about how platform lock-in enables abuse. This evidence shows:

undefined

APPENDIX D: LEGAL IMPLICATIONS

Potential Violations

FTC Consent Decree Context

Meta is already under FTC consent decree for privacy violations. This evidence could constitute:

undefined

*This packet is provided as part of coordinated public interest disclosure. The evidence was gathered through independent security research on commercially available software running on researcher-owned devices.*

*Last updated: December 29, 2025*