COM323e: It was a tin-foil-hatted conspiracy theorist’s wildest prognostication come true: the trusty and beloved iPhones: Crisis Communication Assignment, SUSS, Singapore

It was a tin-foil-hatted conspiracy theorist’s wildest prognostication come true: the trusty and beloved iPhones that accompany users to work, to bed, and even to the toilet suddenly transformed into an all-purpose spying device, transmitting audio and video to anyone with your phone number or email.

But the major flaw in FaceTime has raised concerns about Apple’s security practices just as the company reports disappointing financial results. And reports that a teenager and his mother spent days attempting to alert Apple to the problem have also raised questions about the company’s procedures for receiving reports of vulnerabilities.

Katie Moussouris, the founder of Microsoft’s bug bounty program and CEO of Luta Security, said that the problem for Apple was not that it failed to act quickly enough to patch the bug, but that it failed to manage Thompson’s expectations of how quickly a bug can be patched.

For Apple, the best-case scenario would have been to keep the existence of the vulnerability secret until the patch was tested and ready, Moussouris explained, a process that could reasonably take 30 to 60 days.

“You have to do this balance between thoroughness and timing, and in this circumstance, there were misunderstandings that are understandable, and a missed opportunity for level-setting expectations,” she said.

Carey said that the FaceTime bug was “a black eye” for a company that does indeed have a strong reputation for security and privacy.

“They’re going to have to be fully transparent on how this bug happened, and when it was introduced,” Carey said. “They need to release information about whether they can track to see if it was exploited, and they should notify customers.”

Apple did not respond to numerous queries from the Guardian requesting additional information about the bug.

Apple has come under global scrutiny and criticism for the mass-scale privacy breach as summarised above.

Assume you are the communications director of Apple.

• How would you determine if the crisis has ended and evaluate the effectiveness of your communication to the targeted public? You may propose monitoring methods and key questions to analyze whether the situation has blown over, as well as assess Apple’s respond to the FaceTime bug.
• How can Apple insulate itself from future crises by cultivating a crisis management culture and goodwill with key stakeholders? Your recommendations should also include a corporate responsibility programme that targets a social issue or cause.