These aren't encrypted files. These are data to which they already have access (iCloud Drive, contacts, calendars, and purchases).
From some reports, Apple has always had this capability and selectively used it. The Recovery Key was something you could do on your own, but you could potentially also convince an Apple tech to escalate it and go through an identity-proving process.
What's clear is that people routinely lost or didn't write down their Recovery Key, and one has to intuit it was an ongoing problem and stress for users who enabled "two-step." In this new version, Apple ostensibly could be social engineered, but note that Apple will only engage in account recovery *to a registered phone number*. So you can't call at random, get a random CS person, and do it. You have to apply, they call back (from a team dedicated to it) and only to a number that's registered to the Apple ID account in question.
I spent many hours and many emails with a good accountant, and he advised me not to launch a Kickstarter late in the year! However, there was no better time, and I had to work around the cash-flow issue, as I describe.
The state taxation issue was my fault. I had, in fact, budgeted to spend *more* on tax than I actually owed. So I wouldn't have come up short. Based on my communication with the state, I expect that I would pay different rates on parts of the Kickstarter, and potentially pay up to about 5% to the state in tax. In the actual event, it was about 1.5%.
However, I should have better understand the issue of destination addresses so that I had properly collected that information from everyone. That's something that I've now heard from many other crowdfunding projects about, too.
Further, at least Washington State requires you pay in-state retail business and occupation tax plus sales tax on all sales for which you cannot account for the destination. That can be a huge tax bill.
Thanks, much! Really, I wrote the article in part as a public service, not to be full of myself, because so many people I know have these questions. I have some answers, lots of questions, and lots of places to point people for planning. The commenters here can be awful at times (some are great, thanks!), but they're dwarfed by the number of people who are reading the article.
"aaaaand I'm guessing your compensation is at least partially based on clicks.": Our compensation is based on producing new content that people want to read; clickbait doesn't get us anywhere, because it doesn't turn into people reading the articles, but clicking and leaving. It also earns us anger, which doesn't help foster regular readers. Also, a 4,000-word article about tax issues is usually *not* traditional clickbait under any reasonable definition...
"That's nice, but you're not a lawyer or a tax attorney so my advice is to stop pretending like you are one before someone in a position of authority takes notice."
I love how people who didn't read the article out themselves so clearly!
Absolutely correct in one regard, but some very large business also run on cash if don't make stuff that's inventoried.
I did research it (and mention it in the article) and discuss it with my accountant. Because the publication doesn't really qualify for accrual accounting, it would have invited scrutiny (or worse) had I switched to accrual to get advantageous accounting rules for a specific project.
I researched this and discussed it with my accountant. My accountant said that switching cash-basis business to accrual for the sole purpose of deferring taxes for something that isn't part of its routine business could be met with scrutiny and penalties —and be disallowed.
And the IRS rules make it clear that you can't simply align revenue and expenses. It has a number of examples in which it's clear that in a Kickstarter, the revenue couldn't all be deferred, although the expenses might be allowed to be taken in 2013 if contracts were signed and other tests made.
"You stay here, Audrey -- this is between me and the vegetable!" -- Seymour, from _Little Shop Of Horrors_