The UK government secretly ordered Apple to weaken its iCloud encryption

[thewayne]

This was a government order. And it was a secret. Apple was not allowed to reveal the order. The purpose of the order was allegedly to make it easier for the government to find CSAM, explicit child pornography. It was, in fact, admitting that they were not being very good at their investigations and wanted Apple to make it easier for them.

So Apple broadcast not only that they received the order, they actually broadcast the text of it.

And now they've announced that they are turning off ADP, Advanced Data Protection, a form of advanced encryption of iCloud information in the UK to comply with the order. If you turn on ADP, the only person who can access your data is YOU, which also means that you can lose it. That's the risk of encryption.

Apple basically engaged in naming and shaming the government, good for them! The Home Office said "We do not comment on operational matters, including for example confirming or denying the existence of any such notices." As of this time, Apple users in the UK can no longer turn on ADP, it is expected that with a future update it will be turned off for users who previously activated it.

Without ADP, the information is still encrypted, but it is done in such a way that if the government serves Apple with a warrant, Apple can get at the information. Need I remind people about an incident that I posted about a month or so ago about a back door that the U.S. government required telecommunications providers to install for surveillance purposes that the Chinese have cracked? Several telcom providers have been compromised, and it's an extreme fight to keep them out - it's an on-going problem.

I can't wait for a British tabloid to get ahold of some MP or Lord's data and splash it all over their paper.

https://www.bbc.com/news/articles/cgj54eq4vejo

https://apple.slashdot.org/story/25/02/21/1529255/apple-removes-cloud-encryption-feature-from-uk-after-backdoor-order

Comments

[silveradept]

One of the things that I wish we had access to, but that I assume will be forever covered by Official Secrets or exempted from Freedom of Information requests, etc., is how many times someone makes a request to that backdoor that is actually for the purposes that the backdoor is supposedly installed, and what percentage of all requests made to the backdoor those on-topic, on-purpose, properly done requests are. If it's greater than 10%, I'll be exceedingly surprised. If it's greater than 1%, I'll be impressed.

Still, good on Apple for thumbing their nose at the secrecy part of the request. People deserve to know when their privacy is being compromised by the government for a optimistically negligible benefit in the rate of crime.