Earlier this month, news broke that Apple had been served an order from the U.K. government demanding extraordinary access to its customers’ cloud data. The order, which was issued secretly and forbids Apple from publicly discussing it, was extraordinary in its scope: The U.K. government demanded the ability to view all Apple customer data stored in the cloud, regardless of location.
In no uncertain terms, the U.K. government wanted Apple to build a backdoor to access its cloud encryption, globally. In response to this extraordinary demand, Apple is removing its Advanced Data Protection tool from the U.K.
Apple has consistently, and rightly, resisted creating backdoors to its customers’ data. Data for which Apple holds the encryption key is submitted to law enforcement and other agencies after a lawful request (in the U.S., that means a warrant signed by a judge), but it does not make tools that allow outside agencies to decrypt and access data on its own. What’s more, Apple has worked to make more of your data “end-to-end” (E2E) encrypted, meaning only the customer has the encryption key and Apple does not have the capability to decode it, even if ordered to.
A handful of iCloud services are end-to-end encrypted, but by enabling a tool called Advanced Data Protection (ADP), nearly all iCloud services become so. We have an article that explains the difference between the two encryption methods and shows which services have regular encryption and which are E2E encrypted, both as standard and with ADP enabled.
According to the BBC, the Advanced Data Protection feature is being eliminated from the U.K. in response to the government’s order. If a new customer tries to enable to feature, they are met with a message stating, “Apple can no longer offer Advanced Data Protection (ADP) in the United Kingdom to new users.” The BBC says the feature will be disabled for existing users at a later date.
The UK government did not respond, and would not confirm nor deny the existence of the order that sparked this move. Apple’s comment to the BBC also did not mention the order or any other compliance steps it may be taking, but said it was “gravely disappointed” that the feature will no longer be available for UK customers: “As we have said many times before, we have never built a backdoor or master key to any of our products, and we never will.”
It’s not clear if Apple has taken any other steps to comply with the demand (as it cannot even acknowledge receiving it, by law), other than taking the extraordinary step of vastly weakening the privacy and security of all its users in the U.K.
