The UK government secretly ordered Apple to weaken its iCloud encryption

[thewayne]

This was a government order. And it was a secret. Apple was not allowed to reveal the order. The purpose of the order was allegedly to make it easier for the government to find CSAM, explicit child pornography. It was, in fact, admitting that they were not being very good at their investigations and wanted Apple to make it easier for them.

So Apple broadcast not only that they received the order, they actually broadcast the text of it.

And now they've announced that they are turning off ADP, Advanced Data Protection, a form of advanced encryption of iCloud information in the UK to comply with the order. If you turn on ADP, the only person who can access your data is YOU, which also means that you can lose it. That's the risk of encryption.

Apple basically engaged in naming and shaming the government, good for them! The Home Office said "We do not comment on operational matters, including for example confirming or denying the existence of any such notices." As of this time, Apple users in the UK can no longer turn on ADP, it is expected that with a future update it will be turned off for users who previously activated it.

Without ADP, the information is still encrypted, but it is done in such a way that if the government serves Apple with a warrant, Apple can get at the information. Need I remind people about an incident that I posted about a month or so ago about a back door that the U.S. government required telecommunications providers to install for surveillance purposes that the Chinese have cracked? Several telcom providers have been compromised, and it's an extreme fight to keep them out - it's an on-going problem.

I can't wait for a British tabloid to get ahold of some MP or Lord's data and splash it all over their paper.

https://www.bbc.com/news/articles/cgj54eq4vejo

https://apple.slashdot.org/story/25/02/21/1529255/apple-removes-cloud-encryption-feature-from-uk-after-backdoor-order

Comments

[richardf8]

I can't wait for a British tabloid to get ahold of some MP or Lord's data CSAM and splash it all over their paper.

FTFY

[thewayne]

Heh.

[dewline]

Our governments keep demanding to kneecap themselves and us citizens all at once, don't they?

[thewayne]

Apparently the phrase "What is sauce for the goose is sauce for the gander" has fallen out of style.

[disneydream06]

Well, ain't that a pretty mess. :o :o :o
Hugs, Jon

[kaishin108]

Yes, that could get pretty messy over there with their tabloids, yikes!

[ranunculus]

I have never allowed any salacious or financial info near my phone. Not that there is much of anything to dig up that I don't already talk about if asked.
Originally I heard the heads of very major Silicone Valley corporations say publicaly that they would never be able to make the "cloud" safe from hacking. Then I worked hackers conventions. Nope, nope, not putting any data on my phone. Pretty much no one else I know feels this way.
So now I need to be able to do some kind of electronic payment for my events. Probably Zelle is my best choice. I won't do Pay Pal for historical reasons. Any suggestions on how I stay safe? Use a burner? Just saying I only accept cash is probably not viable. Yeah, I know, I don't work hacker conventions any more and I'm not living in a city where people capable of hacking my phone/bank acct walk past every few minutes -- but. Oh, and yes I have individual, different passwords for absolutely everything.

[thewayne]

It's a nasty world out there, and there's so many reasons why we can't have nice stuff, such as what the UK government is doing.  I use contactless payments through my watch, which has a high level of encryption.  But occasionally it doesn't work, like last night at the movies when their terminals insisted my new card was expired and I had to stick it in the slot for their chip reader to read my chip.  They haven't replaced their terminals in ages, it's a cheap operation.  Many times I've considered getting a flip phone with a 4G/5G hot spot built in, and using an iPod Touch for other things.  But now the iPod is no longer made.

[garote]

Still a good used market for the iPod touch. And I still use an iPod classic, modded to hold 2GB…

[ndrosen]

There is no such thing as a back door which only the good guys can use. Unfortunately, police and intelligence people who want to catch criminals or spy on what terrorists or other foes, are not inclined to see things this way.

[silveradept]

One of the things that I wish we had access to, but that I assume will be forever covered by Official Secrets or exempted from Freedom of Information requests, etc., is how many times someone makes a request to that backdoor that is actually for the purposes that the backdoor is supposedly installed, and what percentage of all requests made to the backdoor those on-topic, on-purpose, properly done requests are. If it's greater than 10%, I'll be exceedingly surprised. If it's greater than 1%, I'll be impressed.

Still, good on Apple for thumbing their nose at the secrecy part of the request. People deserve to know when their privacy is being compromised by the government for a optimistically negligible benefit in the rate of crime.