Apple removes cloud encryption feature in UK after backdoor access order

Don't want to miss the best from Business Standard?

By Mark Gurman

  Apple Inc. is removing its most advanced, end-to-end encrypted security feature for cloud data in the United Kingdom, in a stunning development after the government ordered the company to build a backdoor for accessing user data.

 

The company said Friday that Advanced Data Protection, an optional feature that adds end-to-end encryption — a stronger form of security — to a wide assortment of user data is no longer available in the UK for new users. This layer of security covers iCloud data storage, device backups, web bookmarks, voice memos, notes, photos, reminders and text message backups.

 

“We are gravely disappointed that the protections provided by ADP will not be available to our customers in the UK given the continuing rise of data breaches and other threats to customer privacy,” the company said in a statement. “ADP protects iCloud data with end-to-end encryption, which means the data can only be decrypted by the user who owns it, and only on their trusted devices.”

 

The unprecedented move comes two weeks after media outlets, including Bloomberg News, reported that the UK government ordered Apple to build a backdoor into customer data globally. 

 

Apple previously called a bill from the UK Parliament that sought access to user data “unprecedented overreach by the government.” At the time, the company said that “the UK could attempt to secretly veto new user protections globally preventing us from ever offering them to customers.”

 

Customers already using Advanced Data Protection, or ADP, will need to manually disable it during an unspecified grace period to keep their iCloud accounts. The company said it will issue additional guidance in the future to affected users and that it does not have the ability to automatically disable it on their behalf. The move to pull its encryption feature — rather than complying and building a backdoor — is a clear rebuke of the government’s order.

 

Apple on Friday said that “enhancing the security of cloud storage with end-to-end encryption is more urgent than ever before” and that it “remains committed to offering our users the highest level of security for their personal data and are hopeful that we will be able to do so in the future in the United Kingdom.” 

 

The move to pull its most secure encryption technology in the region appears to be an effort from the iPhone maker to appease UK regulators, though it’s plausible the government will determine the company isn’t going far enough. “As we have said many times before, we have never built a backdoor or master key to any of our products or services and we never will,” Apple said.

 

Users who attempt to enable Advanced Data Protection will receive a message on their iPhone, iPad or Mac that says “Apple can no longer offer Advanced Data Protection (ADP) in the United Kingdom to new users.” Bloomberg News published a guide on how to enable the feature — which remains available elsewhere globally.

 

The removal of Advanced Data Protection in the UK won’t remove end-to-end encryption provided by default for several other Apple features, including iMessage, FaceTime, password management and health data. Some industry watchers speculated that Apple could pull its services from the UK altogether in light of the order, but removing the optional extra security is the company’s compromise — at least for now.

 

Apple has a history of making changes regionally in order to keep offering its products in those markets. For instance, iCloud in China is operated by a local provider, and it is working with Alibaba Group Holding Ltd. on a content filtering system in order to offer its AI features in the region. At the same time, it has pushed privacy as a guiding principle and fought the US government about a decade ago when it asked the company to build a backdoor into iPhone data. 

 

As part of its order to Apple, the UK asked it for access to global user data, Bloomberg News reported. The mandate orders Apple to provide access under the UK’s Investigatory Powers Act, a law that granted officials the authority to compel companies to remove encryption under what’s known as a “technical capability notice.” The law also makes it illegal for companies to reveal when the government has made such an order.

 

“Protecting our users’ privacy and the security of their data is at the very heart of everything we do at Apple,” the company said in response to the 2023 bill from the UK Parliament that sought access to user data.