[gus_massa]

I don't undertand how it can work. I assume the spam list is shared by all users, oherwise it will no be useful at all:

Let's supouse Apple is evil (or they recive an order from a judge) and they want to know who is calling 5555-1234

1) Add a new empty "spam" numbers encrypted database to the server (so there are now two encrypted databases in the system)

2) Add the encrited version of 5555-1234 to it.

3) When someone checks, reply the correct answer from the real database and also check in the second one and send the reply to the police.

[GeekyBear]

> they recive an order from a judge

You can't be forced to hand over customer data after you have designed a system so that your servers don't ever have that information stored in the first place, court order or no.

[lilyball]

The reply is encrypted. Apple doesn't know what it says. Neither would the police.

[colejohnson66]

Encryptions uses per-device keys.

[jakelazaroff]

How would they decrypt the answer from the database?