Too right, it was far more problematic than they ever made out.
> The UK government's demand came through a "technical capability notice" under the Investigatory Powers Act (IPA), requiring Apple to create a backdoor that would allow British security officials to access encrypted user data globally. The order would have compromised Apple's Advanced Data Protection feature, which provides end-to-end encryption for iCloud data including Photos, Notes, Messages backups, and device backups.
One scenario would be somebody in an airport and security officials are searching your device under the Counter Terrorism Act (where you don't even have the right to legal advice, or the right to remain silent). You maybe a British person, but you could also be a foreign person moving through the airport. There's no time limit on when you may be searched, so all people who ever travelled through British territory could be searched by officials.
Let that sink in for a moment. We're talking about the largest back door I've ever heard of.
What concerns me more is that Apple is the only company audibly making a stand. I have an Android device beside me that regularly asks me to back my device up to the cloud (and make it difficult to opt out), you think Google didn't already sign up to this? You think Microsoft didn't?
Then think for a moment that most 2FA directly goes via a large tech company or to your mobile. We're just outright handing over the keys to all of our accounts. Your accounts have never been less protected. The battle is being lost for privacy and security.
> you think Google didn't already sign up to this?
My understanding is that Android's Google Drive backup has had an E2E encryption option for many years (they blogged about it at https://security.googleblog.com/2018/10/google-and-android-h...), and that the key is only stored locally in the Titan Security Module.
If they are complying with the IPA, wouldn't that mean that they must build a mechanism into Android to exfiltrate the key? And wouldn't this breach be discoverable by security research, which tends to be much simpler on Android than it is on iOS?
> What concerns me more is that Apple is the only company audibly making a stand.
But still Apple operates in China and Google does not. This is weird to me. Google left China when the government wanted all keys to the citizens data. Apple is making a stand when it's visible and does not threaten their business too much.
Apple is not really in the business of protecting your data, they are just good at marketing and keeping their image.
> Google left China when the government wanted all keys to the citizens data.
Google left China after China started hacking into Google's servers.
> In January, Google said it would no longer cooperate with government censors after hackers based in China stole some of the company’s source code and even broke into the Gmail accounts of Chinese human rights advocates.
They were working to reenter the China market on China's terms many years later, when Google employees leaked the effort to the press. Google eventually backed down.
China feels like an important difference here though. Google leaving China doesn't protect Chinese citizen's data any more than Apple turning off ADP in the UK does. As far as I know, Apple isn't pretending that the data of Chinese users is encrypted from their government, and the way they're complying with the Chinese laws shouldn't impact the security of users outside of China.
Apple pulling ADP from UK users is similar - the UK has passed an ill-considered law that Apple doesn't think it can win a court case over, so they're complying in a way that minimally effects the security of people outside the UK. If, as someone outside the UK, I travel to the UK with ADP turned on, my understanding is it won't disable itself.
Would you have been more satisfied if Apple just pulled out of the UK entirely? Bricked every iPhone ever purchased there? Google doesn't seem to have made any stand for security ever - them pulling out of China feels more to do with it meaning they wouldn't have had access to Chinese users' data, which is what they really want.
It’s different. Apple follows Chinese law to operate their services in China, just like Microsoft.
With Google, their services are way broader. Operating a hunk of their search business with a third party Chinese firm just isn’t viable for their services, which are way more complex.
The government, with anti trust laws, could easily force this issue. On the other hand, they really love how few places they have to go with FISA warrants to just take anyones data. This is the long tail of the American security state. So it's really ironic that China takes most of the blame.
Perhaps Apple has a greater leverage in China due to its outsized manufacturing presence. And it's likely they already dont offer ADP to Chinese citizens.
Eh Google had pretty good reasons to not operate in China (not seeing them in this thread, don't recall the details precisely enough to relate here)
Apple is deeply embedded in China (manufacturing) and benefits from a decent (but shrinking) userbase in the country. China isn't asking for the keys to all iphone user data, just data stored in China.
> Doesn't the US have access to all the data of non US citizens whose data is stored in the US without any oversight?
Totally agree. Having this discussion so US centred just makes us miss the forest for the trees. Apart from data owned by US citizens, my impression is that data stored in the US is fair game for three letter agencies, and I really doubt most companies would spend more than five minutes agreeing with law enforcement if asked for full access to their database on non-US nationals.
Also, remember that WhatsApp is the go-to app for communication in most of the world outside the US. And although it's end-to-end encrypted, it's always nudging you to back up your data to Google or Apple storage. I can't think of a better target for US intelligence to get a glimpse of conversations about their targets in real time, without needing to hack each individual phone. If WhatsApp were a Chinese app, this conversation about E2E and backup restrictions would have happened a long time ago. It's the same on how TikTok algorithm suddenly had a strong influence on steering public opinion and instead of fixing the game we banned the player.
Android data isn't encrypted at rest (or at least not in a way Google doesn't have the key). If the uk gov has a warrant, they can ask Google to provide your Google Drive content. The whole point of this issue is Apple specifically designed ADP so they couldn't do that.
i think people focus on whether backups are encrypted too much. it really doesn't matter when the government has remote access equivalent to your live phone when it's in an unencrypted state, which they almost certainly do.
> Doesn't the US have access to all the data of non US citizens whose data is stored in the US without any oversight?
Er, no...? I'm not sure where you get that idea. Access requires a warrant, and companies are not compelled to build systems which enable them to decrypt all data covered by the warrant.
See, for example, the Las Vegas shooter case, where Apple refused to create an iOS build that would bypass iCloud security.
Also, I wondered if by complying with British law that they may somehow be breaking laws of another country?
Hypothetically, if Apple just provide a back door to the data they have on US Senators for instance, then providing that information may be considered treason by the US.
That's a totally made up example, and I have no idea, but it seems like it's possibly an issue.
Which is all about the issues around data sovereignty I suppose!
Treason is a very heavy charge and as far as I know it applies more to individuals. Can a company be prosecuted for treason? I guess it depends on the country and I don't know US law well (never even visited there)
But I'm sure local laws conflict heavily between countries yes. I'm often wondering how multinationals manage to navigate this maze. This is why we have such a big legal department I guess :) And the company I work for is a pretty honest one, I've never seen any skullduggery going on with eg privacy or media manipulation. In fact employees are urged to report such things and I have to do a course on responsible behaviour yearly. Probably a result of being purely B2B. But anyway I digress, just wanted to say that getting away with stuff does not seem to be the reason for us having a big legal dept.
But just look at the laws of e.g. the EU and Iran. Pretty diametrically opposed on many topics. There's no way to satisfy them both.
I think what helps to make this happen is that most countries don't try to push their laws outside of their jurisdiction. Which the UK is trying to do here.
> One scenario would be somebody in an airport and security officials are searching your device
No Heathrow connection necessary. “The law has extraterritorial powers, meaning UK law enforcement would have been able to access the encrypted iCloud data of Apple customers anywhere in the world, including in the US” [1].
I don't really understand your comment to be honest. Section 3 of the Regulation of Regulatory Powers Act 2000 allows for compelled key disclosure (disclosure of the information sought instead of the key is also possible). Schedule 7 of the Counter-Terrorism Act allows 9 hour detention, questioning and device search at the border. With these powers it isn't necessary to get access to iCloud backups, as you can get the device and/or the data.
I don't think the e2e icloud backup is problematic under existing legislation / before the TCN. While you can't disclose the key because it lives in the secure enclave, you can disclose the information that is requested because you can log into your apple account and retrieve it. IANAL, but I believe this to be sufficient (and refusing would mean jail).
The Investigatory Powers Act allows for technical capability notices, and the TCN in this case says (as far as we know) "allow us a method to be able to get the contents of any iCloud backup that is protected by E2EE for any user worldwide". This means that there is no need to ask the target to disclose information and if implemented as asked, also means that any user worldwide could be a target of the order, even if they'd never been to the UK.
I imagine they want the ability to look at someone's iCloud backups without notifying the owner that they are doing so or they want to do it when the owner is unwilling or unable to provide keys.
For the latter, there are a lot of cases where jail isn't much a threat (e.g. the person is dead or not in the country).
You have no laws when traveling through immigration. Thats true in US too. There was an article (trying to look for it could be arstechnica verge I dont remember where) once where a US citizen journalist was detained at the border for hours while traveling into the US and questioned. You can be in the immigration for hours or even decades until you give out what they demand which can involve your unlocked phone and password. There are no laws protecting you.
> Apple is the only company audibly making a stand
Apples stand is false, they take with one hand and give with the other. There have been many times that Apple have been caught giving user data to governments at their request, lied about it, then later on admitted it once it had leaked from another source.
This whole 'we will never make a backdoor' is a complete whitewash marketing stunt, why do they need to make a backdoor when they are providing any and all metadata to any government on request.
> There have been many times that Apple have been caught giving user data to governments at their request, lied about it, then later on admitted it once it had leaked from another source.
In other words, Apple complies with legal government orders, as they are required to. The government can compel them with a warrant to hand over data that they have, and can prohibit them from talking about it. That's the whole reason for the push towards end-to-end encryption and for not collecting any data Apple doesn't need to operate the products. This also ties into things like photo landmark identification, where Apple designed it such that they don't get any information about the requests and so they don't have any information that they could be compelled to hand to the government.
Irrespective of political leanings, a lot of British people are saying this. They stand for it because they have to. It's a government that was voted in by a large margin only six months ago. Disquiet, if that's the word, is pretty much universal and I am not sure we've been quite in this position before. Keir Starmer's decline in approval ratings 'marks the most substantial post-election fall for any British prime minister in recent history'.
> What concerns me more is that Apple is the only company audibly making a stand.
Dropping the functionality for a particular market hardly equals to making a stand. Sure they haven't added a backdoor that would give all user's data access to UK icloud user's data so in the end UK residents didn't win anything.
And who knows if they simply have an agreement with US gov to have a backdoor only available to them and not the other govs.
"technical capability notice" under the Investigatory Powers Act (IPA)
Sounds a lot like the godawful "assistance and access" laws that were rushed through in Australia a couple of years ago, right down to the name of the secret instrument sent to the entity who gets forced into to building the intercept capability.
Now that Apple has caved once, I expect to see other providers strongarmed in the same way, as well as the same move tried in other countries.
For photos, it's probably best to use an open-source (also self-hostable) service like Ente. For files it's best to self-host Nextcloud or similar. And rely on other people's computers as little as possible. Sadly, operating systems are very complex and mostly composed of proprietary blobs nowadays so there is still a risk of it leaking data but people can still do at least something.
But if you don't trust Apple, how to you get the key into the Secure Enclave to begin with? Doesn't Apple control the software on your device that provides the interface into the Secure Enclave from outside of it?
> One scenario would be somebody in an airport and security officials are searching your device under the Counter Terrorism Act
No, it's much broader than that. The UK is asking for a backdoor to your data and backups in the cloud, not on your device. Why bother with searching physical devices when they can just issue a secret subpoena to any account they want?
It's actually pretty amazing that Apple made ADP possible for the general public. This is the culmination of a major breakthrough in privacy architecture about ten years ago.
Traditionally you had to make a choice between end-to-end encryption and data recoverability. If you went with E2EE, it's only useful if you use a strong password, but if you forget it then Apple can't help you recover your account (no password reset possible). So that was totally unsuitable for precious memories like photos for the average user.
Apple's first attempt to make this feasible was a recovery key that you print out and stuff in a drawer somewhere. But you might lose this. The trusted contact feature is also not totally reliable either, because chances are it's your spouse and they might also lose their device at that same time as you (for example in a house fire).
So while recovery keys and trusted contacts help, the solution that really made the breakthrough for ADP was iCloud Keychain Backup. This thing is low-key so cool and kind of rips up the previous assumptions about E2EE.
iCloud Keychain Backup makes it possible to recover your data with a simple, weak 6 digit passcode that you are virtually guaranteed never to forget, yet you are also protected from brute force attacks on the server. It is specifically designed to work on "adversarial clouds" that are being actively attacked. This is... sort of not supposed to be possible in the traditional thinking. But they added something called hardware security modules to limit the number of guesses an attacker can make before it wipes your key.
And crucially it ensures you don't forget this passcode because it's your device passcode which the OS keeps in sync with the backup key. This is part of the reason your iPhone asks you to enter your passcode now and then even though your biometrics work just fine.
It is a true secret that only you know and can keep in your brain even when your house burns down and nobody (hopefully) can derive from something they can research about you. This didn't really exist for the general populace until smartphones came along. And that ultimately was the breakthrough that allowed for changing the conventional wisdom on E2EE.
iCloud Keychain Backup came out about a decade ago and it has taken this long to gradually test the feasibility of going 100% E2EE without significantly risking customer data loss. The UK is kind of panicking but when people see how well ADP protects their most personal data from breaches, I think they will demand it. It just wasn't practical before.
> No, it's much broader than that. The UK is asking for a backdoor to your data and backups in the cloud, not on your device. Why bother with searching physical devices when they can just issue a secret subpoena to any account they want?
My point was that there was already a clear chain in place that would give them access to the data of foreign nationals. It's not just a "UK problem", but actually the ramifications are further reaching.
Another thing to consider is that these cookie alerts on sites were for EU countries only, but ended up everywhere. If Apple were to comply, this cloud backdoor could end up in other countries too, with the keys sitting there ready for collection.
To make things more complex still, they would need to support dual/multi nationality. It probably ends up looking like a dual key E2E system where there is a unique key for the end-user and then a third party. Key revocation would likely be difficult, so it would likely be the cloud provided decrypting and re-encrypting the files per request, throwing E2E out the window entirely.
Your smartphone cannot be considered a private device. You as the owner don’t have sufficient control over its operating system and applications to ever make that claim.
In theory you have the likes of the PinePhone where you can run a full Linux kernel [1]. You could then use something like Waydroid to run Android apps [2].
I think the biggest concern is that many of the important apps are anti-emulation, for example banking apps and authentication apps.
It's amusing to think of Apple as a "monopoly" (if anything they have a monopsony on TSMC production) but let's just replace that with "giant" for purposes of discussion.
Tech giants typically devolve local operations to small companies to avoid liability - think petroleum suppliers not owning gas stations (because those typically end up as superfund sites). Not sure if this analogy this works for Google Android and all the manufacturers that deploy it for their smartphones too.
So corporations have been doing this forever, trying to find legal loopholes where they can have their cake and eat it too.
> There's no time limit on when you may be searched, so all people who ever travelled through British territory could be searched by officials.
> Let that sink in for a moment. We're talking about the largest back door I've ever heard of.
Codename 'Krasnov' is the largest backdoor I have ever heard of. And, we only need to look at his behavior.
These E2EE from USA can be tainted in so many ways, and FAMAG sits on so much data, that codename 'Krasnov' can abuse such to target whoever he wants in West. Because everyone you know is or has been in ecosystem of Apple, Google, or Microsoft.
Whataboutism! Fair. From my PoV, as European, the UK government is (still) one of the good guys who will protect Europe from adversaries such as those who pwn codename 'Krasnov'. Such protection may come with a huge price.
The real prescient threat in that movie was the predictive AI algorithm that tracked individual behaviors and identified potential threats to the regime. In the movie they had a big airship with guns that would kill them on sight, but a more realistic threat is the AI deciding to feed them individualized propaganda to curtail their behavior. This is the villain's plot in Metal Gear Solid 2, which is another great story.
> Your persona, experiences, triumphs, and defeats are nothing but byproducts. The real objective was ensuring that we could generate and manipulate them.
It's really brilliant to use a video game to deliver the message of the effectiveness of propaganda. 'Game design' as a concept is just about manipulation and hijacking dopamine responses. I don't think another medium can as effectively demonstrate how systems can manipulate people's behavior.
Life is imitating too many dystopian books, movies, etc these days. I think we need to put an end to all creative works before the timeline becomes irrecoverably destroyed.
It's always hilarious to see how far people here are ready to go to twist some bad Apple news into something which might be considered good.
I mean seriously. Apple making a stand? What stand? They are ripping security out of their customers hands. Customers which are already dependent on the company's decision in their locked in environment.
There is absolutely nothing good about it, and you dragging Android into it and making it look like it's even worse is suspicious. You can have full control over your Android device. Something impossible on an Apple phone. You can make your Android device safer than your iPhone.
The government forced them to pull the feature. Would you rather they left a toggle-switch that doesn't actually do anything? Or are you thinking they should just pull out of the EU altogether?
What I fund 'amusing' is the swap between Left vs Right.
'Back in the day' it was the "Right" that wanted have total access/total control over everything. So people turned a bit "left". Now the "Left" government is seeking totalitarian-style control ('because paedophiles/drugs/etc.).
As a reminder, both Right and Left extremes went from 'liberal/conservatives' to "we don't need elections ever again - trust me!".
I saw this happening in the US, in Saudi (e.g. Blackberry 'keys'). Now I see it in the UK. So I interpret this in two ways:
1) The "Left is the new Right" (or "Right is the new Left")
2) Left and Right are irrelevant terms when it comes down to "we need to exert control over people/knowledge/data/information/etc. And the 'guise' of Left/Right is just on the fiscal policies. So UK has been playing around with 'snooper charter' but at 'that' time Apple's encryption was not on the table.
Apple (I don't blame them - very much - just a little) does what a company does. Makes money. And they prefer to sell-out the data of their clients and keep their money, than lose that money.
So... yeah.. if your data is in someone else's server, that happens.
If you go too far right or left, both types of authoritarianism are difficult to distinguish. I think this just makes the case that every election you need to be a swing voter, make sure your politicians still overlap with your ideals.
Apple today appear to be on the 'correct side of history', but even then you need to be swing consumer.
> What concerns me more is that Apple is the only company audibly making a stand.
They are not making a stand. They roll over without a peep. And this is concerning users' privacy which they say is the core of the company.
Compare it to fighting every government tooth and nail over every single little thing concerning the "we don't know if it's profitable and we don't keep meeting records" AppStore
"Not making a stand" would be leaving everything as is, and handing your encryption keys over to the government. By loudly disabling ADP and saying this feature is illegal in the UK (they really should have said "illegal" instead of "unavailable" so people would know it was the government), they are at least making half a stand. By leaving it enabled in other regions and for visitors from other regions to the UK, they're making three quarters of a stand.
What are you talking about? This is literally them doing the opposite, and there are multiple other public instances of them making a stand, not to mention in the design of their systems.
Fundamentally, I think the issue is more about technical literacy amongst the political establishment who consistently rely on the fallacy that having nothing to hide means you have nothing to fear. Especially in the UK which operates as a paternalistic state and enjoys authoritarian support across all parties.
On the authoritarianism: these laws are always worded in such a way that they can be applied or targeted vaguely, basically to work around other legislation. They will stop thinking of the children as soon as the law is put into play, and it's hardly likely that pedo rings or rape gangs will be top of the list of priorities.
On the technical literacy: the government has the mistaken belief that their back door will know the difference between the good guys (presumably them) and the bad guys, and the bad guys will be locked out. However, the only real protection is security by obscurity: it's illegal to reveal that this backdoor exists or was even requested. Any bad guy can make a reasonable assumption that a multinational tech company offering cloud services has been compromised, so this just paints another target on their backs.
I've said it before, but I guarantee that the monkey's paw has been infinitely curling with this, and it's a dream come true for any black or grey hat hacker who wants to try and compromise the government through a backdoor like this.
It's not literacy. They don't care. They need control, and if establishing control means increased risks for you, it's not something they see as a negative factor. It's your problem, not theirs.
The government put in restrictions against using certain powers in the Investigatory Powers Act to spy on members of parliament (unless the Prime Minister says so, section 26), so I think they're just oblivious to the risk model of "when hackers are involved, the computer isn't capable of knowing the order wasn't legal".
They don't even need control. They want control. Why? Either they're idiots who think they need control or they are tyrants who know they'll need control later on when they start doing seriously tyrannical things.
I used to think it was illiteracy, but when you hear politicians talk about this you realise more often than not they're not completely naive and can speak to the concerns people have, but fundamentally their calculation here is that privacy doesn't really matter that much and when your argument for not breaking encryption based around the right to privacy you're not going to convince them to care.
You see a similar thing in the UK (and Europe generally) with freedom of speech. Politicians here understand why freedom of speech is important and why people some oppose blasphemy laws, but that doesn't mean you can just burn a bible in the UK without being arrested for a hate crime because fundamentally our politicians (and most people in the UK) believe freedom from offence is more important than freedom of speech.
When values are misaligned (safety > privacy) you can't win arguments by simply appealing to the importance of privacy or freedom of speech. UK values are very authoritarian these days.
"Especially in the UK which operates as a paternalistic state and enjoys authoritarian support across all parties."
What is a "paternalistic state". I studied Latin so obviously I understand pater == father but what is a father-like state?
What on earth is: "authoritarian support across all parties".
The UK has one Parliament, four Executives (England, Northern Ireland, Scotland, Wales) and a Monarch (he's actually quite a few Monarchs).
Anyway, I do agree with you that destroying routine encryption is a bloody daft idea. It's a bit sad that Apple sold it as an extra add on. It does not cost much to run openssl - its proper open source.
In medicine, a paternalistic attitude towards the patient from a point of authority (like a father)
The doctor acts as if he knows more and knows what is better. The patient has his own preferences and priorities, but they don't necessarily match with what the doctor does.
I suppose a paternalistic state functions to satisfy the needs of the people, and to define those needs. The people get what the state says is best for them.
Paternalism, unless I'm mistaken, is a belief among those in power that they what's best for you, better than you do, and will exercise power on your behalf in that manner. Just like your parents do when you're a child.
Government knows what’s best for the people (colloquially we call it the nanny state).
All our main political parties have an authoritarian slant so these policies have rarely received long-lasting opposition. Literally every government in office for the past 30-odd years has presented legislation like this.
Are you trying to disagree with them by pretending that they're speaking rubbish? As a Brit, their comment made complete sense to me.
By the way, there is no 'England' executive; it's the government of the United Kingdom, which handles all matters not devolved, in England and the rest of the UK.
> that having nothing to hide means you have nothing to fear
hopefully the US turning from leader of the free world to Russia's tool will give them the kick they need to realise that just because you trust the government now doesn't mean you trust the next government or the one after it.
You probably don't want to look up which US President tried to force Apple to insert an encryption back door into iPhones back in 2015.
However, Google did only start moving to protect location data from subpoenas after people started to worry that location data could be used as a legal weapon against women who went to an abortion clinic, so your larger point stands.
What the politicians want is partial security: something they can crack but criminals can't. That is achievable in physical security, but not in cybersecurity.
I have a feeling the politicians already know partial cybersecurity isn't an option, and don't care. Certainly, the intelligence community advising them absolutely does know. We don't even have to be conspiratorial about it: their jobs are easier in the world where secrets are illegal than in the world where hackers actually get stopped.
> That is achievable in physical security, but not in cybersecurity
This isn't accurate though, and leads us down the path of trying to prevent these bad laws from a technical perspective when we should be fighting the principle of the bad law not just decrying it for being "unworkable".
It is possible to construct encryption schemes with a "backdoor key" while still being provably secure against anyone else.
This creates precisely the "partial security" you describe: Criminals can't crack the encryption, but the government can use their backdoor-key.
But like those who argue online age-consent schemes can't work, it doesn't help to argue against the technical aspects of such bad laws. The law, particularly UK law, doesn't care for what's technically possible. The bad laws can sit on the books regardless of the technical feasibility of enforcement. Eventually technology can catch up, or the law can simply be applied on a best endeavours / selective enforcement approach.
> the government has the mistaken belief that their back door will know the difference between the good guys (presumably them) and the bad guys
This is a very good point, and in the recent months we have been witnessing that people in government, or aiming to become the government, are definitely not the good guys. So, even if what they are asking would be limited to just governments (which it wouldn't), they can't claim they are the good guys anymore.
Just to be clear: Wallace is not a head of state, or even an MP any more. At one point, he was Secretary of State for Defence, a Cabinet position, however he resigned this in 2023.
This doesn’t justify his position (it’s stupid) but he doesn’t speak for the current government.
And that's why it is so important to nip this "pedo" / "think of the children" crap right in the bud.
Obviously pedos on the interwebs are bad, but hey as long as it's just anime they're whacking off to I don't care too much. But the real abuse, that's done by - especially in the UK - rich and famous people like Jimmy Savile. And you're not gonna catch these pedos with banning encryption, that's a fucking smokescreen if I ever saw one, you're gonna catch them with police legwork and by actually teaching young children about their bodies!
"it's hardly likely that pedo rings or rape gangs will be top of the list of priorities".... is this not one of the most disturbing, disgusting, psychologically troubling and damning ideas ever to be put to words/brought to awareness? . Right up there "let's meticulously plan out this horrific, atrocious, dehumanizing act and meditate upon the consequences, and then choose the most brutal and villainous option". Dear Lord....
People are extremely opposed to pedos, so they're a primary rationalization for oppressive technology. But then you have two problems.
First, pedos know everybody hates them, so they take measures normal people wouldn't in order to avoid detection, and then backdooring the tech used by everybody else doesn't work against them because they'll use something else. But it does impair the security of normal people.
Second, there aren't actually that many pedos and the easy to catch ones get caught regardless and the hard to catch ones get away with it regardless, which leaves the intersection of "easy enough to catch but wouldn't have been caught without this" as a set plausibly containing zero suspects. Not that they won't use it against the ones who would have been caught anyway and then declare victory, but it's the sort of thing that's pretty useless against the ones it's claimed to exist in order to catch, and therefore not something it can be used effectively in order to do.
Whereas industrial espionage or LOVEINT or draining grandma's retirement account or manipulating ordinary people who don't realize they should be taking countermeasures -- the abuses of the system -- those are the things it's effective at bringing about, because ordinary people don't expect themselves to be targets.
> is this not one of the most disturbing, disgusting, psychologically troubling and damning ideas ever to be put to words/brought to awareness? .
Hmm? Hell has depths. Your yard might be a little too short to measure them? In that case, just think about this: rape is probably most common in prisons, where you will send innocents the moment this dragnet thing glitches.
> technical literacy amongst the political establishment who consistently rely on the fallacy that having nothing to hide means you have nothing to fear.
That's an awfully generous assessment on your part. Kindly explain just what "technical literacy" has to do with the formulation you note. From here it reads like you are misdirecting and clouding the -intent- by the powerful here.
Also does ERIC SCHMIDT an accomplished geek (who is an official member of MIC since (during?) his departure from Sun Microsystems) suffers from "technical literacy" issues:
I feel like the comment was clear, technical illiteracy leads politicians to believe that they'll be the only ones with access to this backdoor, which isn't true.
Let me offer a possible example that might be more in line with the HN commenting guideline about interpreting people's comments as charitably as reasonably possible:
My password manager vault isn't exactly something to hide in the political sense, but it's definitely something I would fear is exposed to heightened risk of compromise if there were a backdoor, even one for government surveillance purposes. And it's a reasonable concern that I think a lot of people aren't taking seriously enough due, in part, to a lack of technical literacy. Both in terms of not realizing how it materially impacts everyday people regardless of whether they're up to no good, and in terms of not realizing just how juicy a target this would be for agents up to and including state-level adversaries.
As for Eric Schmidt, he's something of a peculiar case. I don't doubt his technical literacy, but the dude is still the head of one of the world's largest surveillance capitalist enterprises, and, as the saying goes, "It is difficult to get a man to understand something when his salary depends on his not understanding it."
If you see a red car driving down the street do you not call it red because there are many other red cars? They're adding color (pun intended) to their description of the general bias of the UK government. What you're doing is called Whataboutism - the argument that others are doing something similar or as bad in different contexts. It doesn't make what the UK is doing any less bad for citizens (and non-citizens) privacy or data sovereignty.
Many people might not be aware of it, but Apple publishes a breakdown of the number of government requests for data that it receives, broken down by country.
Much of this is likely related to the implementation and automation of the US-UK data access agreement pursuant to the CLOUD Act, which has streamlined this type of request by UK law enforcement and national security agencies.
The problem is AFAIK this act is a lot different and Apple or any party that gets this order is completely forbidden to talk about it. So these kind of requests would not show up in this transparency requests. It is IMHO fair to assume Apple will UK this backdoor given they chose to disable Advanced Data Encryption and public would have no insight to amount and reasons to the backdoor usage. It is really troubling.
I don't share your findings, EVERY six-month period between January 2014 - June 2017 shows bigger requests than any six-month period in the last 5 years.
Sad to see the home of the magna carta slowly spiraling down into fascism and 1984. The government should be required to have a specific warrant to get at your personal data.
>Online privacy expert Caro Robson said she believed it was "unprecedented" for a company "simply to withdraw a product rather than cooperate with a government.
That is such a self serving comment. If Apple provides UK a backdoor, it weakens all users globally. With this they are following the local law and the country deserves what the rulers of the country want. These experts are a bit much. In the next paragraph they say something ominous.
>"It would be a very, very worrying precedent if other communications operators felt they simply could withdraw products and not be held accountable by governments," she told the BBC.
I wonder what the impact of Apple withdrawing from China will be. I know we are talking about UK, but this made me think.
Not only their sales will reduce, but hey Chinese manufacturing cuts down. By how much? Will it be impactful? I would think so but wonder if it is quantifiable.
I often notice journalistic pieces interview people and then use maybe 30 seconds' worth of material from a 20-minute interview. The "expert" could have condemned it in any number of ways until the topic of applying data protection laws came up and she said that companies need to be held accountable (could be about GDPR, could be about snooping laws) which the journalist then quoted, not out of malice but because everyone already condemns it and this is the most interesting statement of the interview
Anyway, so while I don't think we should condemn people based on such a single quoted sentence... I took a look at her website and the latest video reveals at 00:38 that she worked for the UK crime agency, which does sound like the one of the greatest possible conflicts of interest for someone called upon for privacy matters rather than crime fighting. Watching the rest of that interview, she approaches it fairly objectively but (my interpretation of) her point of view seems to be on the side of "even with this backdoor, a warrant needs issuing every time they use it and so there's adequate safeguards and the UK crime fighters and national security people should just get access to anything they can get a warrant for"
This is actually an increasing concern, that large multinational companies are so powerful that they don't have to obey governments any more, and can instead blackmail them by withdrawing products. Pornhub has done this in US states. Meta has threatened to do it in various countries. There has always been pushback to regulation from powerful companies, but punishing countries by withdrawing products seems to be used as a tactic more often recently. There are other tools of power companies use as well, like deciding where to create jobs and build facilities. Musk has used that, moving from California to Texas. Defence and oil companies use these tactics also.
I disagree but respect your opinion. Companies have the right to free speech. In the tussle between regulators and companies, companies are disadvantaged. If we can force companies to do the regulators bidding and not allow them to use free speech to act in their best interests, we would have global tyranny. The regulators and companies both acting towards their own goals with freedom allows us to have a world with balance.
I believe in this however I think we are testing limits of this approach with scenarios like the one with encryption. Ideally privacy needs E2E encryption. But concerns on misuse of such technology that governments raise are also not without merit. I wonder if this tussle between regulators and companies can end in any way in which privacy is not compromised. Mathematically it doesn't seem that there is a way to be safe and private.
>"It would be a very, very worrying precedent if other communications operators felt they simply could withdraw products and not be held accountable by governments,"
This would actually be a very very very very VERY GOOD precedent if you ask me.
Facebook pulled something similar when Canada passed the Online News Act and instead of extorting facebook to pay the media companies for providing a service to them (completely backasswards way to do things), they just pulled news out of Canada. I despise Meta as a company, but I had to give them credit for not just letting the government shake them down.
Good riddance. Governments need to be reminded from time to time that they are, in fact, not Gods. We can and should, just take our ball and go play in a different park or just go home rather than obey insane unjust laws.
Note that this doesn’t satisfy the government’s original request, which was for worldwide backdoor access into E2E-encrypted cloud accounts.
But I have a more pertinent question: how can you “pull” E2E encryption without data loss? What happens to those that had this enabled?
Edit:
Part of my concern is that you have to keep in mind Apple's defense against backdooring E2E is the (US) doctrine that work cannot be compelled. Any solution Apple develops that enables "disable E2E for this account" makes it harder for them to claim that implementing that would be compelling work (or speech, if you prefer) if that capability already exists.
That’s exactly the plan. Anyone with this enabled in the UK will need to manually disable it or they’ll get locked out of their iCloud account after a deadline.
The hardware will not allow this, at least not without modifications. The encryption keys are not exportable from the Secure Enclave, not even to Apple's own servers.
> how can you “pull” E2E encryption without data loss
You can’t. The article says if you don’t disable it (which you have to do yourself, they can’t do it for you, because it’s E2E), your iCloud account will be canceled.
We are told the encryption keys reside only on your device. But Apple control “your” device so they can just issue an update that causes your device to decrypt data and upload it.
Apple has already fought US government demands that they push an update that would allow the US governmrnt to break encryption on a user's device.
> In 2015 and 2016, Apple Inc. received and objected to or challenged at least 11 orders issued by United States district courts under the All Writs Act of 1789. Most of these seek to compel Apple "to use its existing capabilities to extract data like contacts, photos and calls from locked iPhones running on operating systems iOS 7 and older" in order to assist in criminal investigations and prosecutions. A few requests, however, involve phones with more extensive security protections, which Apple has no current ability to break. These orders would compel Apple to write new software that would let the government bypass these devices' security and unlock the phones.
Apple is in a really tough position. I don't know if there's any way they could fulfil the original request without it effectively becoming a backdoor. Disabling E2E for the UK market is just kicking the can down the road.
Even simply developing a tool to coerce users out of E2E without their explicit consent to comply with local laws could be abused in the future to obtain E2E messages with a warrant on different countries.
> Any solution Apple develops that enables "disable E2E for this account" makes it harder for them to claim that implementing that would be compelling work (or speech, if you prefer)
I think it’s really speech [0], which is why it’s important to user privacy and security that Apple widely advertises their entire product line and business as valuing privacy. That way, it’s a higher bar for a court to cross, on balance, when weighing whether to compel speech/code (& signing) to break E2EE.
After all, if the CEO says privacy is unimportant [1], maybe compelling a code update to break E2EE is no big deal? (“The court is just asking you, Google, to say/code what you already believe”).
Whereas if the company says they value privacy, then does the opposite without so much as a fight and then the stock price drops, maybe that’d be securities fraud? [2]. And so maybe that’d be harder to compel.
>> Apple's defense against backdooring E2E is the (US) doctrine that [government can’t] be compelling work (or speech, if you prefer)
It’s really not "work” but speech. That’s why telecoms can be compelled to wiretap. But code is speech [2], signing that code is also speech, and speech is constitutionally protected (US).
The tension is between the All Writs Act (requiring “third parties’ assistance to execute a prior order of the court”) and the First Amendment. [1]
So Apple may be compelled to produce the iCloud drives the data is stored on. But they can’t be made to write and sign code to run locally in your iPhone to decrypt that E2EE data (even though obviously they technologically could).
> how can you “pull” E2E encryption without data loss? What happens to those that had this enabled?
They'll keep your data hostage and disable your iCloud account. Clever, huh? So they are not deleting it, just disabling your account. "If you don't like it, make your own hardware and cloud storage company" kind of a thing.
Think about it.. You don't even have to be an Apple user to be affected by this issue. If someone backs up their conversations with you to apple cloud, your exchange is now fair game. You get no say in it either.
Setting a retention time out is playing with fire. If the police get ahold of the other party's device, and present an exhibit which they say contains the true conversation, you could be worse off than if you retained the conversation. The fact that you have since deleted it could be incriminating.
In some jurisdiction, yes, legally, such evidence might not be probative, but you might still convicted because of it.
Very similar to sites like LinkedIn, which ask you to share your personal info & contact list.
I don't want to share my contact details, but the second someone I know decides to opt in, I lose all rights to my own data as they've shared it on my behalf.
Maybe they have other info, such as birthday, home address, other emails or phone #s, etc. stored for me, which is all fair game, as well.
Security hinges on trust. The only real privacy tool is PGP which uses a web of trust model. But it only works if people own their own computers and storage devices. What they've done is got everyone to rent their computers and storage instead. There's no security model that works for the users here.
> Online privacy expert Caro Robson said she believed it was "unprecedented" for a company "simply to withdraw a product rather than cooperate with a government".
> "It would be a very, very worrying precedent if other communications operators felt they simply could withdraw products and not be held accountable by governments," she told the BBC.
Attributing this shockingly pro-UK-spy-agencies quote to an "online privacy expert" without pointing out she consults for the UN, EU and international military agencies is typical BBC pro-government spin. In fact, Caro, it would be "very, very worrying" if communications operators didn't withdraw a product rather than be forced to make it deceptive and defective by design.
Free speech already under threat and now y'all are giving up the right of private communication too? For anyone cheering this on, do you honestly think this will only affect the "bad people", and you'll never have your own neck under the government's boot? Even if you trust the government today, what happens when your neighbors elect a government you disagree with ideologically?
Instead of the word cheering we could use letting.
Bad people flourish over the inaction of good people.
(but yes, there are always several who protect and argue for things risking their own and everyone's livelihood, exposing themselves to shady elements, along singled out and elevated thin aspects, cannot understood why)
I have a naive question, and it's genuine curiosity, not a defence of what's happening here.
This ADP feature has only existed for a couple of years, right? I understand people are mad that it's now gone, but why weren't people mad _before_ it existed? For like, a decade? Why do people treat iCloud as immediately dangerous now, if they didn't before?
Did they think it was fully encrypted when it wasn't? Did people not care about E2E encryption and now they do? Is it that E2E wasn't possible before? If it's such a huge deal to people now, why would they have ever used iCloud or anything like it, and now feel betrayed?
I guess I'm one of the people who was upset that it didn't exist before, and I didn't enable iCloud Backup as a result. I didn't use iCloud Photos. I had everything stored on a NAS (which was in-fact encrypted properly) and used a rube goldberg-esque setup to move data to it periodically. I used iMazing and local encrypted backups on a schedule.
Lots of people called for E2EE on this stuff, but let's be real about one thing: encryption as a feature being more accessible means more people can be exposed to it. Not everyone can afford a rube goldberg machine to backup their data to a NAS and not make it easily lost if that NAS dies or loses power. It takes immense time, skill, and energy to do that.
And my fear isn't the government, either, mind you. I simply don't trust any cloud service provider to not be hacked or compromised (e.g., due to software vulnerability, like log4j) on a relatively long timescale. It's a pain to think about software security in that context.
For me, ADP solves this and enables a lot of people who wouldn't otherwise be protected from cloud-based attacks to be protected. Sure, protection against crazy stuff like government requests is a bonus, but we've seen with Salt Typhoon that any backdoor can be found and exploited. We've seen major exploits in embedded software (log4j) that turn out to break massive providers.
So, there were people upset, their concerns were definitely voiced on independent blogs and random publications, and now, we're back in the limelight because of the removal of the feature for people in the UK.
But, speaking as a user of ADP outside of the UK, I am happy that ADP is standing up for it, and thankful that it exists.
(To be clear: government backdoors, and government requests also scare me, but they aren't a direct threat to myself as much as a vulnerability that enables all user data to be viewed or downloaded by a random third-party).
Many of us were very upset about Apple's slow-rolling this feature. There were many claims that they delayed the rollout due to government pressure [1] (note: that story is by the same reporter who broke today's news a couple of weeks ago.)
Rolling out encryption takes time, so the best I can say is "finally it arrived," and then it was immediately attacked by the U.K. government and has now been disabled over there. I imagine that Apple is also now intimidated to further advertise the feature even here in the U.S. To me this indicates we (technical folks) should be making a much bigger deal about this feature to our non-technical friends.
At one point in time, the entirety of web communication was completely unencrypted.
Why were people not mad then? Do you think people would be angrier now, if HTTPS were suddenly outlawed?
Among other valid answers, removing rights and privileges generally makes people angrier than not having those rights or privileges in the first place.
Oh, we were. I am in the crowd who had been asking for generally used encryption since 1995. After all, we were already using SSH for our shell connections.
The first introduction to SSL outside of internet banking and Amazon was for many online services to use encryption only for their login (and user preferences) page. The session token was then happily sent in the clear for all subsequent page loads.
It took a while for always-on encryption to take hold, and many of the online services complained that enabling SSL for all their page loads was too expensive. Both computationally and in required hardware resources. When I wrote for an ICT magazine, I once did some easy benchmarking around the impact of public key size for connection handshakes. Back then a single 1024-bit RSA key encryption operation took 2ms. Doubling it to 2048 bits bumped that up to 8ms. (GMP operations have O(n^2) complexity in terms of keysize.)
Counterpoint: when web communication was unencrypted it was before we did our banking, tax filing, sent medical records, and sent all other kinds of sensitive information over the internet. The risks today are not remotely the same as they once were.
always used my own encryption and cyphered any sensitive data/communications, but the problem is that most people won't and you're often compromised by them
simple solutions like Whatsapp, Signal and ADP brought this to the masses - which some governments have issues about - and this makes a massive difference to everybody including those who wouldn't be caught dead using an iphone anyway
if we could go back to the early 1990s when only professionals, Uni students, techies and enthusiasts used the internet I'd go in a heartbeat but that's not the world we're living in
You've always been able to perform encrypted backups to your own local PC or Mac out of the box, so people who do care about privacy have always had that option.
One thing I've found concerning is that Apple had encrypted cloud backups ready to roll out years ago, but delayed releasing the feature when the US government objected.
> After years of delay under government pressure, Apple said Wednesday that it will offer fully encrypted backups of photos, chat histories and most other sensitive user data in its cloud storage system worldwide, putting them out of reach of most hackers, spies and law enforcement.
Yes, I was mad before it existed and didn't use icloud backups. With the E2E and ADP I turned it on. If it gets nuked in the US I'll go back to encrypted local backups only.
People learn stuff over time. If you are not living like RMS you probably are allowing something to spy on you. If that spying gets removed you become aware. You don't want it back.
It is like anything that gets better. Fight for the better. It is like aviation safety: who cares about a few crashes this year when people didn't complain in the 70s.
- e2e encryption is not ubiquitous yet, but awareness is ascending.
- distrust for government also is on the uptrend.
- more organized dissent to preserve privacy.
No people didn't assume data was encrypted.
Yes E2E has been possible for many decades, but businesses don't have privacy as a priority, sometimes even counter incentives to protect it. Personal data sells well.
Things have changed because more people are getting to understand why it matters, forcing the hand of companies having to choice but at least feign to secure privacy.
iCloud and iPhones have traditionally resisted US governmental overreach, only giving data to iCloud in cases of actual criminal prosecution against specific individuals. As well, iPhone backups in iCloud is relatively new, as are many other arbitrary storage features — it used to just be your songs and your photos! Now it’s data from all of your apps and a full phone backup. Hence the resistance: the stories of police being unable to recover data from a locked iPhone may now be over
Apple has been advertising security and privacy as a top feature for years now. It would make sense for people to get upset if those features were removed.
People were mad. Remember the Snowden leaks and PRISM program from NSA? [1]
In fact, Apple began to adopt “privacy” first marketing due to this fallout. Apple even doubled down on this by not assisting FBI with unlocking a terrorist suspects Apple device in 2016. [2]
It was around that time I actually had _some_ respect for Apple. I was even a “Apple fanboy” for some time. But that respect and fanboi-ism was lost between 2019 and now.
Between the deterioration of the Apple ecosystem (shitty macOS updates), pushing scanning of photos and uploading to central server (CSAM scanning scandal?), the god awful “Apple wall”, very poor interoperability, and very anti-repair stance of devices.
The situation was not something existed since the beginning of time, it evolved gradually. Long ago not that much and not that many critically private data was circulating the net, it increased and got essential living online by time, in some instances forced in an increasing portion of situations. Worry then had no grounds yet. As exposure of the population grew, so did the benefit for adverse elements breaking online data stores, growing in numbers fast, not all made properly in the headless chase of success. Damage and hence awareness grew gradually.
But basically yes, people are stupid and gave no shit but believed all f nonsense, the marketing frauds made them eating up their crap happy if it had pretty words and pictures, promising something halfway to Paradise. Like the Cloud mirage. Those of careful personality were cautious since the first time Apple and alike pushed on people giving up control over their own data for tiny comfort (or no comfort eventually due to all hostile patterns in the full picture) not putting all and every precious or slightly valuable stuff to some unknown server on the internet protected only by hundreds of years old method: password (so not protected at all essentially). Memories, contacts, schedules, communications, documents, clone of their devices in full, putting all into 'cloud' (much before secure online storage became a thing)? Many times to the very same one? Who are that much idiots, really?!
iCloud did a lot less, in the past. Disabling it now gives you access to more data than it did a few years ago. And I also suspect it has far more users today than it did a few years ago.
The problem here is not with iCloud but with the U.K. government. People like to tell themselves the government isn’t actually trampling their rights but events like this make it impossible to ignore.
The nightmare continues.
For now I am using 3rd party backup services that are (currently) promising me that my backups are encrypted by a key they do not have access to, or control over.
But can this even be believed in an age where these secret notices are being served to any number of companies?
I suppose the next step would be to ensure that files don't ever arrive in the cloud unencrypted, but I have yet to see a service that allows me to do this with the same level of convenience as, say, my current backup solution, which seamlessly backs up all my phones, my family members' phones, my laptops, their laptops etc.
I depend on having an offsite backup of my data. Which inevitably includes my clients' data also. Which I am supposedly keeping secret from outside access. So how does that work once everything becomes backdoored?
In the case of the U.K., they can throw you in jail for not handing over your encryption key, so it’s a moot point. They’ve been slowly expanding this power for twenty years now.
Not for content in the cloud, as far as I understand. Someone will correct me, but you can be arrested and threatened with terror charges if you dont unlock your device, but this does not give them permission to access other computers via the internet.
ive been through all this with the law. no one ever got jailed for not handing over encryption keys unless they were a definitive criminal and theres strong evidence there is criminal data on the device.
they tried this with me (NCA) but the judge wouldnt sign off as they had nothning on me or my device. this did however REALLY want to access it! fuck them. pricks
Convenience usually comes at a cost. You shouldn't have to trust anyone. Just use a generic storage service and only upload encrypted files to it. Syncthing + Rclone will probably get you a similar setup that you control.
IMO the only thing you can have a high level of trust in is your own *nix server. Backup those devices to it then encrypt there before being sent to the cloud.
Handling the encryption yourself is the way to go, but for maximum security, don't send that encrypted data to the cloud. Keep it all on your own server(s).
That doesn't help people who aren't technically capable, of course. But at least those who are can protect themselves.
As a citizen, I don’t understand what the UK government thinks they are getting here - other than the possibility of leaks of the nation’s most sensitive data.
Also is it not possible to set up my Apple account outside of the UK while living here?
> other than the possibility of leaks of the nation’s most sensitive data
Amusing when you consider the National Cyber Security Centre (NCSC, a part of GCHQ), along with the Information Commissioners Office, both publish guidance recommending, and describing how to use, encryption to protect personal and sensitive data.
Our government is almost schizophrenic in its attitude to encryption.
I suppose they don't believe certain facts engineers are telling them. With Brexit it was coined "Project Fear". Now they're being told that adding backdoors to an encrypted service almost completely erodes trust in the encryption and, as in the case with Apple here, in the vendor. However, I suppose it is very hard to find objective facts to back this. I'd guess this is why Apple chose to both completely disable encryption and inform users about the cause.
Now we're probably just waiting for a law mandating encryption of cloud data. Let's see whether Apple will actually leave the UK market altogether or introduce a backdoor.
In the US, the NSA has always had both missions (protect our country’s data and expose every other country’s data). Since everyone uses the same technology nowadays, that’s a rather hard set of missions to reconcile, and sometimes it looks a little ridiculous. As of fairly recently, they have a special committee that decides how to resolve that conflict for discovered exploits.
Correct me if I'm wrong here, and maybe this is too charged for HN, but looking over at you guys from the US:
The US has problems (don't get me wrong, look at our politics, enough said); but the UK seems to be speedrunning a collapse. The NHS having patients dying in hallways; Rotherham back in the popular mind; a bad economy even by EU standards; a massive talent exodus (as documented even on HN regarding hardware engineers); a military in the news for being too run down to even help Ukraine; and most relevant to this story - the government increasingly acting in every way like it is extremely paranoid of the citizens.
I mean, this is no different than one part of the government suggesting running laundry at night to reduce the environmental impact of energy use, while another suggests only running it while awake to reduce fire hazard. Governments and corporations rarely have complete internal alignment.
I don't know, they've definitely been cracking down on journalists over the past year. Could be an attempt to crack down harder / create a chilling effect
btw, anyone know if this cancels Apple+ Support too? I’ve been resisting switching countries because I don’t want to lose that subscription since you can only subscribe within 60 days of device purchase.
> Also is it not possible to set up my Apple account outside of the UK while living here?
The ability to turn on Advanced Data Protection does seem to be tied to your iCloud region (as of now I can still turn it on, and I’m in the UK but have an account from overseas).
full control on everyone they deem as an opponent. in UK being dimmed and oponent is about posting the wrong meme or even standing in the wrong street at the wrong moment.
I'm sympathetic to the J.D. Vance angle, which is that European governments are increasingly scared of their own people. This is not doing a lot to change my mind.
They are not scared of people, but of working, doing their job, especially when it is difficult (catching criminals). They expect the job to be done for them by others, on the expense of everyone, while they collecting all the praise.
On sympathetic to Vance I did not really found a presentable reaction, would not find on any other accidentally agreeable sentence leaving his mouth (very low chance btw.). Talking a lot about all kind of things sooner or later will hit something acceptable, which will not yield an unacceptable and destructive to society figure sympathetic.
You also should be aware of practices and conducts the various US security services practice (and probably all governemnts out there), if not from news or law but at least from the movies. When we come to the topic of who is afraid of their own.
Exactly, it's the same thing with the Chat Control law in the EU and it reminds me of the scene in the movie Office Space where the consultants are trying to figure out who is doing what in the company.
Basically instead of doing their jobs, the cops expect Apple, Meta et al to intercept all the data, then feed it into some kind of AI black box (not done by them but contracted out to someone else at the taxpayer's expense) that will then decide if you get arrested within the next 48H (I am exaggerating but only slightly)
What are the cops doing instead of doing their jobs? That's my question. Aren't they paid to go out and catch the criminals or do they simply expect to get the identity of people each day that need to be investigated?
Well put. It's pretty much impossible to sympathize with Vance saying this when the administration he is a part of is scaremongering about "the enemy within".
Governments should be scared of their people, though not in the way that I expect Vance means.
It's certainly better than the opposite, where citizens and residents are scared of their government, which wields the power to deprive them of their freedom, possessions, and life.
>Governments should be scared of their people, though not in the way that I expect Vance means.
A guillotine once in a while for some politicians/bureaucrats will do some good. There is a rich history of the French doing it. I'm not even trying to be funny.
To give you a counterpoint: from this side of the pond it is extremely surprising to see how effective Vance's speech has been in distracting a good proportion of the American public. Which, I have to suspect, was the real point.
This can set a dangerous precedent. Now why wouldn’t any country demand the same, basically eliminating Advanced Data Protection everywhere, making user data easily accessible to Apple (and therefore governments)?
When UK demanded a backdoor to e2ee in iMessage, Apple told them they’d rather get out of UK. Why not do the same here? You’re posing a false dichotomy.
It isn't really a precedent. Companies, even high-rolling American tech companies, have to abide by the laws and regulations of the countries that they operate in. I guess there is a question of whether this is a legal demand that they truly had to follow, or just a request, and whether they could fight it in court, but Apple seems to be hoping to adjudicate it in the court of public opinion (apparently the initial backdoor request was secret and it got leaked).
What are you actually supposed to do in the UK if you oppose this sort of thing to stop laws like this coming in? It feels like the government has been incredibly out of touch for the last number of years.
Probably the best on the civil liberties front are the Liberal Democrats (they were pretty good at quashing mandatory national ID cards back in the day, at least).
That being said, they still have a lot of folk angry at them for allowing university fees to be introduced 15 years ago when they were in coalition government (a Tory policy!).
The current EU-UK adequacy decision[1] is up for review this 27 June [2] .
Aspects of the UK investigatory powers act is close enough to US FISA [2] that I think this might have some influence, if brought up. IPA 2016 was known at the time of the original adequacy decision, but IPA was amended in 2024 . While some things might be improvements, the changes to Technical Capability Notices warrant new scrutiny.
Especially seeing this example where IPA leads to reduced security is of some concern, I should think. The fact that security can be subverted in secret might make it a bit tricky for the EU to monitor at all.
Presumably not, politicians have a way of excepting themselves in these types of laws. It's almost as if they understand the need for privacy, they just fail to apply that understanding to any scenarios beyond their own.
I meant that Apple's decision to withdraw ADP applies to them, not the Investigatory Powers Act. Or are you saying that Apple will give them a free exemption?
So many questions around this that need answering, such as:
1. What happens if I have ADP enabled and then visit the UK? Will photos I take there still be E2E encrypted? If not, will I be notified? I realize that at the moment the answer is yes, that for now, they are only disabling ADP enrollment. But they are planning to turn it off for everyone in the UK in the future. So what happens then?
2. If they make an exception for visitors, such as by checking the account region, then obviously anyone in the UK who cares about security will just change their account region - a small inconvenience. Maybe this will be a small enough group that the UK government doesn’t really care, but it could catch on.
3. Is this going to be retroactive? It’s one thing to disallow E2E encryption for new content going forward, where people can at least start making different decisions about what they store in the cloud. It’s an entirely different thing for them to remove the protection from existing content that was previously promised to be E2E encrypted. When they turn off ADP for people who were already enrolled, how is their existing data going to be handled?
These are important questions, particularly 2 because even a layover in London or Dublin puts you under UK jurisdiction. So now you have to put that into account when traveling.
The precedent here is China. I spent a few days in China and, as far as I know, my region is still <other country> and ADP is still active.
The smartphone is a terrible platform. Something like this could never happen on the PC, where you can install any encryption and backup software that you want.
While Apple did the right thing by refusing to give the UK government a backdoor, they are responsible for getting users in this situation in the first place.
I'm not familiar with the iPhone and maybe there is already an alternative to iCloud ADP, although that would make this whole situation completely nonsensical.
I'm on arch. Still, while I agree that Windows is becoming more closed, you are still free to create and distribute Windows app without asking anyone for permissions.
If we are saying "secure", we should talk about what we are securing and against whom.
A smartphone may be secure against malicious individual actors but its certainly not the most secure when it comes to your private data. Modern day smartphone is designed to maximize capturing your private information like location, communication patterns, activity and (sometimes) health information and pass it on to as many private players(a.k.a apps) as possible, even to governments without your knowledge. You don't have much control over it.
In that aspect it is less secure than your typical PC. A PC doesn't have that level of private information in the first place and whatever information it has will leak only if you opt-in or get infected by malware.(recent Windows versions without necessary tweaks may be considered a malware by some).
But along with that also comes a massive pressure point for rogue states to take advantage of. With a diversity of services this would not be nearly as possible.
I haven’t checked lately but since it launched the iPhone has allowed the owner to choose whether to back up to Apple’s servers (which would be affected by the UK order) or back up to their local computer.
It's not an either-or, actually, even though the setting is worded like it is. But even if you have cloud backups enabled, you can still manually trigger a local backup.
The more I live I’m less concerned about what are often described as “bad actors”. The bad actors are often the state, and this kind of information is collected without thought to the risk of future politicians who don’t follow the rules or who don’t have any respect for the laws.
Through all history state security has been a thing. The Stasi and KGB are transparently state security forces to the West, but the CIA and MI5/6 are... what exactly?
The primary purpose of these agencies, despite what has been written down on paper, is NOT to protect the citizens of the countries that fund them. It is to protect the system that taxes those citizens.
States are not inherently good, they are just large organisations with a monopoly on certain social functions. All large organisations have the capacity to inflict terrible harm.
As far as I know you can still opt to backup your entire iPhone to a local computer instead of iCloud.
You can also manually transfer photos to the computer. Or you can enable a different app (Google Photos or Dropbox for example) to store copies of every picture you take, and then turn off iCloud Photos.
Note that neither Google nor Dropbox are E2E encrypted either though.
The reason is that Apple was never required by UK law to offer any alternative. I think the DSA intended to challenge that, but it would do nothing for UK residents.
The best time to turn on ADP was before this happened. For folks not in the U.K., the second best time is right now. The more people who use it, the more disruptive it will be to turn off.
Keep in mind there are some risks with any E2EE service! You’ll need to store a backup key or nominate a backup contact, and there’s a risk you could lose data. Some web-based iCloud services don’t work (there is a mode to reactivate them, with obvious security consequences.) for what it’s worth, I’ve been using it for well over a year (including one dead phone and recovery) and from my perspective it's invisible and works perfectly.
Open the Settings app.
Tap your name, then tap iCloud.
Scroll down, tap Advanced Data Protection, then tap Turn on Advanced Data Protection.
Follow the onscreen instructions to review your recovery methods and enable Advanced Data Protection.
On Mac
Choose Apple menu > System Settings.
Click your name, then click iCloud.
Click Advanced Data Protection, then click Turn On.
Follow the onscreen instructions to review your recovery methods and enable Advanced Data Protection.
I'm guessing this is because they haven't figured out a way to do it yet. I'm not very well versed in how these systems work but surely this type of encryption can't be disabled by Apple remotely (or they would have that backdoor they don't want)?
If you care, then it's time to ditch iPhone and Android phones altogether. It's not like anything they offer will be safe. You need to invest instead in a FairPhone with e/OS or a PinePhone or some similar alternative. Something where you have complete control of the software and ideally the hardware.
I really wish they would sit down and negotiate this more openly. The silence from the other players is what really makes me uncomfortable. The fact that only Apple is making a stand against this ask is really scary.
Right but then you are jailed at Heathrow for not unlocking your phone.
The UK has made it clear that Counter Terrorism legislation has no limits in UK law even if that means compromising all systems and leaving them vulnerable to state actor attacks.
MPs will continue to use encrypted messaging systems that disappear messages during any inquiries of course.
I'm in a similar position. Strongly considering replacing my iPhone with a Pixel. But I realize I'm vulnerable via cloud services. GrapheneOS won't save me from someone poking through my Dropbox. I'll have to find another option for that too.
Devil's Advocate (meaning I don't agree with this, in fact I disagree with it, but I don't see this argument being made anywhere and think it would be interesting. If you're one of the people who are offended by this practice of people steel-manning "the other side" and only want to read comments that affirm your position, please don't read this comment).
Question: Wouldn't it be better for Apple to build a UK-only encryption that is backdoored but is at least better than nothing? If Apple really cared about people's privacy, why just abandon them?
My position: No because this is a war, not a battle. Creating a backdoored encryption would immediately trigger every government on the planet passing laws banning use of non-back-doored encryption, which would ultimately lead us to a much, much worse world. Refusing to do it is the right thing IMHO.
The UK's law here is specifically targetting encrypted data globally.
> The UK government's demand came through a "technical capability notice" under the Investigatory Powers Act (IPA), requiring Apple to create a backdoor that would allow British security officials to access encrypted user data globally.
Without Advanced Data Protection, your data is still encrypted at rest, it's just that Apple safeguards the encryption key. The purpose of ADP is to remove control of this key from Apple, so that it's impossible for Apple to leak your data to any third party, even if they are compelled to.
So to me, backdoor encryption seems like it defeats the whole point of ADP, no? But if not - even if there is some tiny marginal benefit - cryptography is extremely expensive to get right. It's doubtful that it makes financial sense to Apple to develop a new encryption workflow for a single country for very slight security benefits.
And it still wouldn't be complying with the UK's demands anyways. The UK demanded access to accounts worldwide. If Apple is going to be non-compliant, then they might as well be non-compliant the easy way.
>> Lowering the data protection of it's citizens in comparison to the rest of the world. I was under the impression governments were supposed to protect their citizens.
This depends on whether you see "citizens" as individuals or as a group.
In other words it's possible that to improve the security (and thus protect) the majority, the rights of individual citizens need to be eroded.
For example, to protect vulnerable citizens from crime (the cliche of child porn is useful here, but it extends to most-all crime) it's useful for prosecutors to be able to collect evidence against guilty parties. This means that the erosion of some privacy of those parties.
Thus the govt balances "group security" with "individual privacy". It has always been so. So to return to your original hypothesis;
>> Lowering the data protection of it's citizens in comparison to the rest of the world.
... and also, making it easier to detect and prosecute criminals, and thus protect the citizens from physical harm.
Now, of course, whenever it comes to balancing one thing against another, there's no easy way to make everyone happy. We all want perfect privacy, coupled with perfect security. Some will say that they'll take more privacy, less security - others will take more security and less privacy. Where you stand on this issue of course depends on which side you lean.
More fundamentally though there's a trust issue. Citizens (currently) do not trust governments. They assume that these tools can be used to harm more than just criminals. (They're not wrong.) If you don't trust the govt to act in good faith then naturally you choose privacy over security.
"also, making it easier to detect and prosecute criminals, and thus protect the citizens from physical harm."
Did this happen though? Whilst I agree with your philosophy, in reality the UK government are no closer to lawfully accessing our data, but our data are less protected from potential other threats (e.g. unlawful access to a data centre, rogue Apple employees).
It's what actually happened as opposed to the government intention that matters to the people affected.
So my statement "Lowering the data protection of it's citizens in comparison to the rest of the world" still stands, and I'd add "whilst the UK government achieved absolutely zero in its quest to lawfully access individual's data".
I'm not familiar with UK law, but what's the matter? They're equally valid in jurisdictions that I know of, a signature is a signature no matter where it was put
I'd personally just trust the government variant more with my government ID data than a third party but that's up to the petitioners to weigh and decide
What's stopping Apple from launching an AppleTV-esque device that functions as personal iCloud storage?
The design of ADP is that even taking control of the data centre won't allow access to the information held within. Decentralising the service makes it significantly harder to write ham-fisted legislation that aims to prevent tech companies from offering secure products.
Additionally there isn't a technical need for ADP to interface with iCloud. Apple could feasibly release free software for DIY ADP.
My expectation is that either the UK will alter the law, or Apple will work around it. I don't think we're looking at the end of this.
Commercial security is pure theatre at the end of the day. Apple could pretend to make a big stink, release a new encrypted Time Machine or leave the UK... but why? None of that makes them money. It's a band-aid for the user freedom that was amputated decades ago.
I don't expect Apple to fight this like, say, the EU regulations. Without a profit incentive, it's hard to mobilize Apple to seek a solution.
They keep asking for more and more ridiculous powers, but then someone on a terrorist watchlist will go and stab a bunch of toddlers. They don’t need more powers, they need to just do their jobs.
> Caro Robson said she believed it was "unprecedented" for a company "simply to withdraw a product rather than cooperate with a government".
She believes wrong. Google retreated from the Chinese market to not give in. Apple stayed in China and also banned VPNs on App Stores for Chinese customers. Kudos to Apple to not giving in to a backdoor in this case but some there companies took a even higher moral stand in some other situations, so there is precedent indeed.
While Apple especially under Tim Cook has done a lot questionable acquiescences under Cook for political expediences, they really didn’t have a choice here. It was the law.
Now going back on Twitter to get in the good graces of President Musk and bringing TikTok back to the AppStore even though it is clearly against the law is different.
But Apple is not giving the UK Government anything they didn't already have. Now iCloud encryption will function in the UK just as it has for years (decades?) before the inception of ADP.
They heavily compete on "privacy" and "security", so I wouldn't expect them to. Additionally, once you start rolling with one government, every one wants you to do something for them while offering you no additional money for the work and weakening of your project.
"Existing users' access will be disabled at a later date."
Hmmm how? How can they decrypt your already end-to-end encrypted and uploaded data without you entering the passphrase to do so? I can understand them removing the data from iCloud completely, or asking you to send the keys to Apple, but I don't understand how they can disable the feature for already uploaded data.
What if the users don't agree to disable ADP? So if one pays for iCloud+, they'll be refunded? And what happens to their already uploaded data? Is it deleted?
I am going to say something a bit controversial around here, but all of this E2E and security stuff is just lip service for marketing to consumers.
These companies have to comply with so many laws and want cozy relationships with governments, so they play both sides. It likely does things differently, but if the keys are not secure, then its not secured
Apple could have disabled iCloud completely for UK users. This would protect both UK users and other users who’s data would also been captured in an iCloud backup.
They would lose some money on services, but would have been the better choice to stand up to the UK government and protect the UK users.
It's fine to continue providing the service as long as people know it's not encrypted. I am not worried about my photos being subpoenaed; I am worried about losing them. I'd rather have the service.
If you have ADP, Leave it on and have them automatically delete it at some point? Otherwise yes.
“Customers who are already using Advanced Data Protection, or ADP, will need to manually disable it during an unspecified grace period to keep their iCloud accounts, according to the report. Apple said it will issue additional guidance in the future to affected users and that it "does not have the ability to automatically disable it on their behalf."
I'm confused. I thought iCloud was end-to-end encrypted anyway, and I've never heard of ADP before. Is ADP encryption at rest, whereas normal iCloud storage is only encrypted from the device to the server?
Does this mean I should treat travel to the UK the same way as China and only bring a burner device with no information on it or on cloud backup accounts?
Border control agents in all countries -- including the US -- have fairly extensive powers to search your devices or deny you entry. I'm not sure this decision should change your calculus on that point.
Could moves like this by other repressive regimes finally open the door to consumer-owned, consumer-controlled, decentralized cloud storage systems that are fully encrypted and inaccessible by any agency or individual except by the owner?
Would be a beautiful thing to see. Not sure how storage would work though since you cannot take payment (that would make it centralized), and storage would have to be distributed, but by who?
> "Apple saw this as a point of principle - if they were going to concede this to the UK then every other government around the world would want this."
How is withdrawing the full encryption capability from UK users not condeding to the UK government?
They are not the first country to do this. Apples advanced security features are rolled out non-uniformly across global markets. You get different capabilities, depending on where you are and where your account is resident, it would be great if there was a website that listed the countries and the security protections Apple provides in those countries.
Wonder what the cost/benefit looks like from Apple's perspective.
If this requirement increases the proportion of data on Apple's servers that is now unencrypted (or encrypted but which can be trivially unencrypted), that could be a huge plus to Apple; more data to use for ad targeting (or to sell to third parties), and more data to train AI models on.
This provides an incentive for Apple computer users to do the right thing: Stop storing sensitive data on Apple servers. Unfortunately, due to Apple's pre-installed proprietary operating systems that phone home incessantly, that may be more challenging than it should be.
Can someone explain what's changed in the UK that they would consider requesting unfettered access to all Apple customer data (including outside their own borders)? I get that the NSA is infamous for warrant-less surveillance, but this seems a step further.
It is "just" the domestic intelligence agency ordering Apple to backdoor their own system be able to supply data for lawful interception. As I read the article, it's not a UK backdoor in the sense they can roam around in every users data. The domestic agencies still need to follow the rules of lawful interception, namely they need a warrant, and it is targeted at UK nationals only. At least that is how I read the article.
This isn't warrant-less, it's with a warrant. This isn't really a change the UK, it's the UK trying to adapt to the proliferation of E2E encryption - ten years ago, law enforcement could always access your messages, now the default if you're on whatsapp/iMessage is they can't because E2E is on by default. UK lawmakers aren't happy with a default position of the state being totally incapable of reading messages, no matter what the law says.
It might not be cryptographically sensible, but it is responding to a real change in the strength of the state.
Labour Party was elected six months ago. It is doubling down on existing government surveillance policy as a cure-all weapon to investigate and chill opposition, and to humble foreign tech companies.
This is part and parcel of the collapse of western capitalism (aka American empire). You get two main choices when capitalism fails - fascism or communism/socialism. It's clear that the UK has chosen fascism (either liberals like Labor or extreme right like Reform).
That choice exists only in cases in which the people can effect a revolution. The UK elite is too strongly in control of the country through its establishment, so, it will be a loud tumble down the hillside towards fascism...
concessions afer concessions we gave away our freedom. the axis of good is mostly responsible for this but the opposition also wanted to remove anonymity and freedom from the web.
no one fought when the democrats called snowden or assange russian spys for revealing clinton corruption. they just blindly sided with their own corrupt political party and gave away freedom. just like previous govs censored trump, banned political opponents they created a precedent and opened the door to the end of freedom. its now beyond politics, we should fight for the last moments of freedom we have before its too late.
So instead of building a back door they're just completely removing the option to use E2E encryption altogether, thus making everything freely available to government by default?
How is that not worse or at least equivalent to a back door?
>How is that not worse or at least equivalent to a back door?
It's bad for the citizens of the UK and better for everyone else on the planet with an iPhone. UK citizens should be angry with their government, not Apple.
It _is_ equivalent to a back door, that's the point. The UK demand can be accessed more rapidly and properly by disabling the feature than by implementing a backdoor, since it is the same thing.
I think the iCloud services is based on the region of your Apple Account. So you could theoretically use a US region Apple Account and enjoy iCloud services. But that means you won't get UK region apps, except in the app store you can switch to different Apple Accounts as you please, so you can have multiple accounts for different regions (which is what I do).
I always thought that metadata and circumstantial evidence is enough to incriminate someone. Do you really need plaintext data and communication to put criminals behind bars?
Could this be the catalyst for the rise of third party encryption companies that operate in UK?
Or perhaps, rise to third party self host E2E cloud solution?
Ugh. Is this by App Store country? Anyone know what happens if I already have it configured? I’m actually in US App Store region and sometimes switch to UK… I wonder if that would disable it.
Not really? We've had horrors like the 2000 RIP[0] well before Brexit. The Blair government made a huge dent in civil liberties and the Tories carried it on.
Your comment history reeks of differentiated, sensible arguments...
Overall quite ironic as in plain sight to anyone reading the news in the last two years, almost all of Western Europe sees rising right wing and extreme right wing parties.
Nothing is happening to it. Governmental overreach, and then if people really want encryption they will vote in privacy-friendly officials. Here in Oregon, USA, we have Ron Wyden, who knows more about netsec than most IT graduates.
As long as you can vote there is still civil liberty, just vote for the right people who care about this stuff.
It's just a shame that Apple didn't include the contact details for the Home Office officials responsible as the place for inquires regarding the matter.
It means Apple has the encryption keys to your backed-up data. So they can, in theory, access it, if the UK Gov demands that they do. That might never happen to you, but with ADP it would have been impossible, because even Apple can't access it.
Potentially. It really just means your data is stored unencrypted, so anybody that has access to Apple's servers can access your data. I don't believe any government has open access to Apple's servers, but they can get a warrant.
They always could. With advanced data protection they could not. The law mandated to add a backdoor to allow the government to also see encrypted data (which made the encryption insecure by definition). Apple refused to comply so you don’t even have the option to encrypt your backups now.
No, EU is NOT "all for privacy". I don't know where this myth comes from but I see it repeated here often.
1. EU is pushing for mandatory on-device scanning of all your messages (chat control). The current proposal includes scanning of all videos and images all the time for all citizens. The proposal started with analyzing all text too. The discussions are happening behind close doors. EU Ombudsman has accused EU commission of "maladministration", no response.
2. EU is allowing US companies to scan your emails and messages (ePrivacy Derogation). Extended for 2025.
3. EU is pushing for expansion of data retention and to undermine encryption security (EU GoingDark).
"The plan includes the reintroduction and expansion of the retention of citizens’ communications data as well as specific proposals to undermine the secure encryption of data on all connected devices, ranging from cars to smartphones, as well as data processed by service providers and data in transit." https://www.patrick-breyer.de/en/eugoingdark-surveillance-pl...
4. EU is pushing for mandatory age verification to use email, messengers and web applications. Citizens will be required to use EU approved verification providers. All accounts will be linked back to your real identity.
5. "Anonymity is not a fundamental right": experts disagree with Europol chief's request for encryption back door (January 22, 2025)
Do you still believe EU is all for privacy? EU's privacy is deteriorating faster than in any other developed country / bloc. Some of these proposals have been blocked by Germany for now but that is expected to change after the upcoming elections.
< EU is pushing for mandatory on-device scanning of all your messages (chat control)
Again and again, 'Eu' is not pushing anything like that. A few Euparl MPs backed by those like Ashton Kutcher did.
> Eu isnt 'planning' anything like that. Some Euparl MPs backed by people like Ashton Kutcher tried to push a law to spy on all chat apps. Then when the dirty web of American-style regulatory manipulation was exposed, they backed off. It was a proposal for a law by some MPs. Not something 'Eu' did.
The EU has been pushing to pass the Chat Control law for the last 3 years which is even worse because at least in the UK the government would still need to get a warrant for the data they want whereas the EU wants to analyze your chat messages, emails and pictures in real time without cause or need to justify themselves.
That works for nerds like us. But my sister or my non tech friends don't have knowledge to self host. It is like asking a person to do a surgery on themselves when they don't have medical knowledge. E2E services are very crucial for such normal people.
How long do you think for governments to make it illegal to self host or backdoor Linux builds? They have already went too far by just asking backdoor to data of every single person on the planet. We should oppose such unethical laws rather than finding workarounds.
> How long do you think for governments to make it illegal to self host or backdoor Linux builds?
Probably never, it won't be worth the trouble because it's always going to be a fringe thing for the reasons you say :). One can hope anyways.
Also, if the government decides I'm a baddie, they can always just show probable cause to a judge and come physically get my hardware, so they have a more traditional path there to handle weirdos like me already :).
FWIW, I agree completely strong encryption in SAAS is necessary for privacy. But pragmatically, there's little hope laws like this won't eventually take root in more places. So the statement stands irregardless of the challenges: the cloud is just someone else's computer.
One final note: I don't think E2E means what most people think it means unfortunately - lots of companies imply that you're the only one with access to the encryption keys when E2E is on, but if you read the fine print, it often really just says is the data is encrypted in flight, not what the policy is for protecting the data on the other "end."
This is the awesome thing about ADP - they spell out the full policy in glorious detail.
For those to whom that sounds scary: buy a regular consumer NAS. They run quite a few applications nowadays (besides being file storage as a base feature) and are meant to be setuppable by an average person
Not relevant to the Apple story but as a general comment on UK surveillance/search/detainment laws: Five Eyes means the US just needs to get their citizen into the UK for their partner to gain access that the US doesn't have to their citizen. The reciprocity possibilities are endless.
If you own an iPhone then nothing can come close to the feature set of iCloud. Apple just have it on lockdown and dont expose the functionality that would be needed for a competitor to take advantage of this.
A great time for all people to jump to android IMO and experience the freedom of choice it gives you.
As a British citizen I am amazed at how much the government has invaded our privacy. I think it started after 9/11 when they first introduced terrorism laws and saw they could get away with it. I wonder if the ruling classes are nervous, given the state and direction of our economy and the inequality, as well as the iron grip a small part of the country has maintained on society. They are perhaps making preparations for a class revolt.
Having said that, in practice to date the extraordinary powers the government has acquired are rarely used, eg to quell the race riots last year. It feels more like a risk for the future and that makes it harder to argue against now. One day this will hit the fan.
I’m very curious, however, to see Americans criticise our government for its (mostly theoretical) overreach, whilst simultaneously the constitution of America is being torn to shreds by the actions of Musk and Trump, with some in the tech community even cheering on DOGE.
Please could you expand? I'm very confused by what's going on in the states, particular the attitude in the tech community, so any clarity would be appreciated!
The problem with that is that if the user loses their key, their account is no longer recoverable. As things are with ADP, enabling it comes with a bunch of warnings about that, and IIRC it also forces you to print out the recovery key for safe storage.
ok so while being AI safety concerned.. uk politicians go ahead and remove humanity's single logical control tool that they have to keep AI in check.. encryption maths.
Honestly I'm surprised that rather than trying to build stupid backdoors and such, tyrannical governments don't just try to make a encryption key database. They hold ALL the keys and can get into anything they want, anytime they want. If you get caught with keys or encrypted data they can't access, punishment ensues.
Like if you're gonna try to eliminate privacy and freedom, just be honest and open about your intentions.
This is a good reminder that the one who cares about privacy and security cannot rely on closed-source products from commercial companies; don't be deceived by marketing slogans.
You do realise that the UK government is, and always has been, notorious for surveillance. They haven't changed since before WW2 and probably never will, even if Apple suddenly decides to play hardball with them.
And to be very, very honest, if you look across the Five Eyes nations, I don't think this is much different from what other countries deal with when it comes to access to data. You had PRISM, the trick of asking other countries for access to their own citizens data to avoid scrutiny, and Apple delaying the implementation of E2E in the US after federal agencies got pissed about it. The list goes on for a long time. At least in the UK, the government is so detached from commoners hurt feelings that they ask for what they want explicitly, with no fear of political consequences.
He was stuck in an airport when his passport got cancelled. It's not really a free choice if you can't go anywhere else, and planes suspected of carrying you get forced to land, even if by virtue of being denied airspace access until they run out of fuel.
freedom to _what_? Corruption is high, media is pretty restricted under Orban, and it doesn't look all that great for freely expressing your identity either. Whether Poland will follow their direction or manage to turn around is still up in the air.
You're only more "free" there if you have the money to bribe officials.
Snowden didn’t go to Russia because of the government there “valuing personal freedoms,” he went there bevause it is one of the very few major countries that absolutely will not cooperate with any extradition requests from western countries.
If you are thinking of going to east europe (and especially Russia) in search of personal freedoms, I got a bridge to sell you (for context, I grew up in Russia). The only “freedom” some of those countries might provide is the freedom from the long reach of the hands of western governments (and even that is a “maybe”, as Andrew Tate has been discovering recently).
Kremlin has full access to every service operating in Russia. If a service is banned in Russia, that's a service you should use. If it's not banned, it already has a backdoor.
Dubai, even as an international hub where you may be able to get by with English — لا تضيع وقتك باستخدام دولينجو لتعلم اللغة العربية، لقد حاولت خلال الوباء وما زلت لا أعرف الأبجدية — is much more authoritarian than the UK. Similar for Singapore.
If you're monolingual, and privacy is your concern, then the US is an improvement over Australia.
But also consider Canada and Ireland.
Ireland isn't in Five Eyes, Canada is, but also Canada is slightly further away from the madness of Trump etc. than any company still inside the USA.
I'm not even sure what's going to happen with the US federal government given that DOGE cannot meet its stated goals even by deleting all discretionary-budget federal agencies like the NSA, CIA, FBI, all branches of the armed forces, etc. but on the other hand the private sector is busy doing a huge volume of spying anyway in the name of selling adverts… chaos is impossible to predict, and you should want to predict things at least a few years out if you're going to the trouble of relocating.
This was done under the Investigatory Powers Act which was brought in in 2016. Saying that Labour weren't exactly against it at the time. Point being snooping isn't left or right - they all love it.
The Blairite wing of that party has always been extremely bad with this kind of thing (see Tony Blair's obsession with ID cards over the decades) so it's unsurprising they'd push something like this.
This is Apple condeeding. Apple lost. UK Government got (almost) what they wanted - a backdoor into iCloud accounts.
Apple's only consolation prize is that its limited to UK users for now. But it seems inevitable that ADP will gradually be made illegal all around the world.
Given that they’ve only prevented new signups it looks to me more like Apple is trying to apply pressure to the U.K. government to get them to back down. The law that permits this was passed in 2016 so the situation was default lost already.
There was a lot of campaigning against the Investigatory Powers bill when it was introduced. It didn't help much given the people in power want more power regardless of where they sit on the political spectrum.
I can't imagine many here (UK) will really care, we've had multiple breeches of privacy imposed on us by the powers that be. - Removed incorrect assumption of this not being reported.
> In the UK, there's no right to bear arms, so people are pretty helpless against their oppressing government.
When people want to revolt it doesn’t seem like the right to bear arms has much to do with it. Not having the right to bear arms certainly hasn’t stopped countless rebellions and revolutions across the world. It’s not like the French of the Russians had a right to bear arms before their successful revolutions.
Even in the UK, the lack of a right to bear arms didn’t stop Cromwell using firearms to defeat Charles II at the Battle of Worcester.
Technically I guess you're right, but one hopes that the foundations of British democracy provide its citizens with the tools to fight against an oppressive government. The only rub is getting them to stand up and do that.
Small arms are no match for drones and a fully armed military, a successful rebellion by any populace against a first world military is impossible unless the military lays their arms down voluntarily, full stop.
NO, it's the wrong choice. Most people do not understand this stuff enough to truly care about, and they just want their devices to work. This is an awful decision by Apple. There's really nothing consumers can do to pressure the British government.
Yes, countries lacking in proportional representation and having obscure procedures like proroguing parliament are the best at listening to important but fairly obscure issues from their voters. </s>
Wow - how sad. To think the 2nd highest scoring post ever on hacker news is Apple's 2016 A Message to Our Customers. A display of intelligence, morality and courage under great pressure: https://hn.algolia.com
How things have changed.
> In a statement Apple said it was "gravely disappointed"
I would much rather they were transparent, so that people can move services, rather than build a backdoor in secret, to appease the far-left Labour government.
Workers in tech jobs over the past few decades are the ones who are primarily to blame for the total degradation of the very notion of privacy, and our societies are, I think, reaping the consequences of this now in many ways.
This story didn't spring up out of nowhere, like a monster from under the bed. It's been a gradual decline since, let's say, the 90s or so.
I don't want to be vulgar, but the people who understood the best what was happening were mostly too busy taking large paychecks to get too upset about the whole thing. It got explained away, rationalised, joked about, and here we are.
Easier to push away the blame for a foot soldier, claiming to do things on orders or claiming to be absolutely f clueless where it leads, one is worse than the other. Thousands had to make this work and function as it is.
Still, this is a different topic than the government use of law enforcement for preserving the shity situation that was built by the industry and its actors just when the trend becomes of fixing what was made to be crap, just when people want to correct the f up of the ignorant collaborants.
Too right, it was far more problematic than they ever made out.
> The UK government's demand came through a "technical capability notice" under the Investigatory Powers Act (IPA), requiring Apple to create a backdoor that would allow British security officials to access encrypted user data globally. The order would have compromised Apple's Advanced Data Protection feature, which provides end-to-end encryption for iCloud data including Photos, Notes, Messages backups, and device backups.
One scenario would be somebody in an airport and security officials are searching your device under the Counter Terrorism Act (where you don't even have the right to legal advice, or the right to remain silent). You maybe a British person, but you could also be a foreign person moving through the airport. There's no time limit on when you may be searched, so all people who ever travelled through British territory could be searched by officials.
Let that sink in for a moment. We're talking about the largest back door I've ever heard of.
What concerns me more is that Apple is the only company audibly making a stand. I have an Android device beside me that regularly asks me to back my device up to the cloud (and make it difficult to opt out), you think Google didn't already sign up to this? You think Microsoft didn't?
Then think for a moment that most 2FA directly goes via a large tech company or to your mobile. We're just outright handing over the keys to all of our accounts. Your accounts have never been less protected. The battle is being lost for privacy and security.
> you think Google didn't already sign up to this?
My understanding is that Android's Google Drive backup has had an E2E encryption option for many years (they blogged about it at https://security.googleblog.com/2018/10/google-and-android-h...), and that the key is only stored locally in the Titan Security Module.
If they are complying with the IPA, wouldn't that mean that they must build a mechanism into Android to exfiltrate the key? And wouldn't this breach be discoverable by security research, which tends to be much simpler on Android than it is on iOS?
My assumption is that Google has keys to everything in its kingdom [1].
[1] https://qz.com/1145669/googles-true-origin-partly-lies-in-ci...
92 replies →
Apple's ADP is not E2E for only its backups, it's E2E for _everything_ in iCloud Drive and a few other iCloud services.
Could that be true and at the same time a 'vulnerability' exists that megacorp is party to?
> What concerns me more is that Apple is the only company audibly making a stand.
But still Apple operates in China and Google does not. This is weird to me. Google left China when the government wanted all keys to the citizens data. Apple is making a stand when it's visible and does not threaten their business too much.
Apple is not really in the business of protecting your data, they are just good at marketing and keeping their image.
> Google left China when the government wanted all keys to the citizens data.
Google left China after China started hacking into Google's servers.
> In January, Google said it would no longer cooperate with government censors after hackers based in China stole some of the company’s source code and even broke into the Gmail accounts of Chinese human rights advocates.
https://www.nytimes.com/2010/03/23/technology/23google.html
They were working to reenter the China market on China's terms many years later, when Google employees leaked the effort to the press. Google eventually backed down.
1 reply →
China feels like an important difference here though. Google leaving China doesn't protect Chinese citizen's data any more than Apple turning off ADP in the UK does. As far as I know, Apple isn't pretending that the data of Chinese users is encrypted from their government, and the way they're complying with the Chinese laws shouldn't impact the security of users outside of China.
Apple pulling ADP from UK users is similar - the UK has passed an ill-considered law that Apple doesn't think it can win a court case over, so they're complying in a way that minimally effects the security of people outside the UK. If, as someone outside the UK, I travel to the UK with ADP turned on, my understanding is it won't disable itself.
Would you have been more satisfied if Apple just pulled out of the UK entirely? Bricked every iPhone ever purchased there? Google doesn't seem to have made any stand for security ever - them pulling out of China feels more to do with it meaning they wouldn't have had access to Chinese users' data, which is what they really want.
2 replies →
iCloud in China is operated by a local subsidiary. There is a dedicated screen explaining this when you set up an iCloud account in this region.
They adapt to the local rules of each region, much like they’re doing here in the UK.
1 reply →
It’s different. Apple follows Chinese law to operate their services in China, just like Microsoft.
With Google, their services are way broader. Operating a hunk of their search business with a third party Chinese firm just isn’t viable for their services, which are way more complex.
I want to buy my phone from a phone manufacturer.
I want to backup my data with a managed service.
I do NOT want these to be the same company.
The government, with anti trust laws, could easily force this issue. On the other hand, they really love how few places they have to go with FISA warrants to just take anyones data. This is the long tail of the American security state. So it's really ironic that China takes most of the blame.
Perhaps Apple has a greater leverage in China due to its outsized manufacturing presence. And it's likely they already dont offer ADP to Chinese citizens.
6 replies →
Eh Google had pretty good reasons to not operate in China (not seeing them in this thread, don't recall the details precisely enough to relate here)
Apple is deeply embedded in China (manufacturing) and benefits from a decent (but shrinking) userbase in the country. China isn't asking for the keys to all iphone user data, just data stored in China.
> have an Android device beside me that regularly asks me to back my device up to the cloud
But is that backup encrypted? If it's not, all they need is <whatever piece of paper a british security official needs, if any> to access your data.
This is about having access to backups that are theoretically encrypted with a key Apple doesn't have?
> We're talking about the largest back door I've ever heard of.
Doesn't the US have access to all the data of non US citizens whose data is stored in the US without any oversight?
> Doesn't the US have access to all the data of non US citizens whose data is stored in the US without any oversight?
Totally agree. Having this discussion so US centred just makes us miss the forest for the trees. Apart from data owned by US citizens, my impression is that data stored in the US is fair game for three letter agencies, and I really doubt most companies would spend more than five minutes agreeing with law enforcement if asked for full access to their database on non-US nationals.
Also, remember that WhatsApp is the go-to app for communication in most of the world outside the US. And although it's end-to-end encrypted, it's always nudging you to back up your data to Google or Apple storage. I can't think of a better target for US intelligence to get a glimpse of conversations about their targets in real time, without needing to hack each individual phone. If WhatsApp were a Chinese app, this conversation about E2E and backup restrictions would have happened a long time ago. It's the same on how TikTok algorithm suddenly had a strong influence on steering public opinion and instead of fixing the game we banned the player.
12 replies →
> non US citizens whose data is stored in the US
They don't even care where it's stored...
See: CLOUD Act [1]
[1] https://en.wikipedia.org/wiki/CLOUD_Act
1 reply →
Android data isn't encrypted at rest (or at least not in a way Google doesn't have the key). If the uk gov has a warrant, they can ask Google to provide your Google Drive content. The whole point of this issue is Apple specifically designed ADP so they couldn't do that.
3 replies →
> But is that backup encrypted? If it's not, all they need is <whatever piece of paper a british security official needs, if any> to access your data.
Based on them mentioning the difficulty of opting out, I presume OOP does not use Google's cloud backup.
i think people focus on whether backups are encrypted too much. it really doesn't matter when the government has remote access equivalent to your live phone when it's in an unencrypted state, which they almost certainly do.
> Doesn't the US have access to all the data of non US citizens whose data is stored in the US without any oversight?
Er, no...? I'm not sure where you get that idea. Access requires a warrant, and companies are not compelled to build systems which enable them to decrypt all data covered by the warrant.
See, for example, the Las Vegas shooter case, where Apple refused to create an iOS build that would bypass iCloud security.
18 replies →
Also, I wondered if by complying with British law that they may somehow be breaking laws of another country?
Hypothetically, if Apple just provide a back door to the data they have on US Senators for instance, then providing that information may be considered treason by the US.
That's a totally made up example, and I have no idea, but it seems like it's possibly an issue.
Which is all about the issues around data sovereignty I suppose!
That would not be treason, by a long shot.
Treason is the only crime defined in the constitution, and it is quite a high bar.
3 replies →
Treason is a very heavy charge and as far as I know it applies more to individuals. Can a company be prosecuted for treason? I guess it depends on the country and I don't know US law well (never even visited there)
But I'm sure local laws conflict heavily between countries yes. I'm often wondering how multinationals manage to navigate this maze. This is why we have such a big legal department I guess :) And the company I work for is a pretty honest one, I've never seen any skullduggery going on with eg privacy or media manipulation. In fact employees are urged to report such things and I have to do a course on responsible behaviour yearly. Probably a result of being purely B2B. But anyway I digress, just wanted to say that getting away with stuff does not seem to be the reason for us having a big legal dept.
But just look at the laws of e.g. the EU and Iran. Pretty diametrically opposed on many topics. There's no way to satisfy them both.
I think what helps to make this happen is that most countries don't try to push their laws outside of their jurisdiction. Which the UK is trying to do here.
> (where you don't even have the right to legal advice, or the right to remain silent)
A lot is posted about LEO's lying in the US, this seems worse.
> One scenario would be somebody in an airport and security officials are searching your device
No Heathrow connection necessary. “The law has extraterritorial powers, meaning UK law enforcement would have been able to access the encrypted iCloud data of Apple customers anywhere in the world, including in the US” [1].
[1] https://www.ft.com/content/bc20274f-f352-457c-8f86-32c6d4df8...
The US claims the same
https://en.wikipedia.org/wiki/CLOUD_Act
Lots of Americans in this thread seem to be talking down to other countries laws while being completely unaware of their own
2 replies →
> What concerns me more is that Apple is the only company audibly making a stand.
Meta also said they would make a stand if a similar request comes for WhatsApp. I'm not going to hold my breath though.
They wouldn't even be able to.
WA is end-to-end encrypted.
7 replies →
I don't really understand your comment to be honest. Section 3 of the Regulation of Regulatory Powers Act 2000 allows for compelled key disclosure (disclosure of the information sought instead of the key is also possible). Schedule 7 of the Counter-Terrorism Act allows 9 hour detention, questioning and device search at the border. With these powers it isn't necessary to get access to iCloud backups, as you can get the device and/or the data.
I don't think the e2e icloud backup is problematic under existing legislation / before the TCN. While you can't disclose the key because it lives in the secure enclave, you can disclose the information that is requested because you can log into your apple account and retrieve it. IANAL, but I believe this to be sufficient (and refusing would mean jail).
The Investigatory Powers Act allows for technical capability notices, and the TCN in this case says (as far as we know) "allow us a method to be able to get the contents of any iCloud backup that is protected by E2EE for any user worldwide". This means that there is no need to ask the target to disclose information and if implemented as asked, also means that any user worldwide could be a target of the order, even if they'd never been to the UK.
Relevant info:
- https://wiki.openrightsgroup.org/wiki/Regulation_of_Investig...
I imagine they want the ability to look at someone's iCloud backups without notifying the owner that they are doing so or they want to do it when the owner is unwilling or unable to provide keys.
For the latter, there are a lot of cases where jail isn't much a threat (e.g. the person is dead or not in the country).
1 reply →
You have no laws when traveling through immigration. Thats true in US too. There was an article (trying to look for it could be arstechnica verge I dont remember where) once where a US citizen journalist was detained at the border for hours while traveling into the US and questioned. You can be in the immigration for hours or even decades until you give out what they demand which can involve your unlocked phone and password. There are no laws protecting you.
> Apple is the only company audibly making a stand
Apples stand is false, they take with one hand and give with the other. There have been many times that Apple have been caught giving user data to governments at their request, lied about it, then later on admitted it once it had leaked from another source.
This whole 'we will never make a backdoor' is a complete whitewash marketing stunt, why do they need to make a backdoor when they are providing any and all metadata to any government on request.
https://www.macrumors.com/2023/12/06/apple-governments-surve...
> There have been many times that Apple have been caught giving user data to governments at their request, lied about it, then later on admitted it once it had leaked from another source.
In other words, Apple complies with legal government orders, as they are required to. The government can compel them with a warrant to hand over data that they have, and can prohibit them from talking about it. That's the whole reason for the push towards end-to-end encryption and for not collecting any data Apple doesn't need to operate the products. This also ties into things like photo landmark identification, where Apple designed it such that they don't get any information about the requests and so they don't have any information that they could be compelled to hand to the government.
I think that’s the whole point of their push to E2E encrypt as much as possible. Saying they can’t unencrypted something worked for a while.
Remember that the last fiasco was related to 2FA stores being stored unencrypted on google's backup cloud, namely google authenticator.
And yes, it's still pwnable this way, and happens regularly.
Everything in the cloud is not yours anymore, and you should always treat it like that.
What is going on in the UK? How do they stand for this?
Irrespective of political leanings, a lot of British people are saying this. They stand for it because they have to. It's a government that was voted in by a large margin only six months ago. Disquiet, if that's the word, is pretty much universal and I am not sure we've been quite in this position before. Keir Starmer's decline in approval ratings 'marks the most substantial post-election fall for any British prime minister in recent history'.
https://politicalpulse.net/uk-polls/keir-starmer-approval-ra...
3 replies →
When “misinformation” or “hate speech” are illegal, and the government decides what those are, you cannot risk complaining
> What concerns me more is that Apple is the only company audibly making a stand.
Dropping the functionality for a particular market hardly equals to making a stand. Sure they haven't added a backdoor that would give all user's data access to UK icloud user's data so in the end UK residents didn't win anything.
And who knows if they simply have an agreement with US gov to have a backdoor only available to them and not the other govs.
"technical capability notice" under the Investigatory Powers Act (IPA)
Sounds a lot like the godawful "assistance and access" laws that were rushed through in Australia a couple of years ago, right down to the name of the secret instrument sent to the entity who gets forced into to building the intercept capability.
Now that Apple has caved once, I expect to see other providers strongarmed in the same way, as well as the same move tried in other countries.
For photos, it's probably best to use an open-source (also self-hostable) service like Ente. For files it's best to self-host Nextcloud or similar. And rely on other people's computers as little as possible. Sadly, operating systems are very complex and mostly composed of proprietary blobs nowadays so there is still a risk of it leaking data but people can still do at least something.
This is why, while I applaud what Apple is doing here, they need to allow us to supply our own E2E encryption keys.
That’s literally what the feature they’re removing did.
10 replies →
But if you don't trust Apple, how to you get the key into the Secure Enclave to begin with? Doesn't Apple control the software on your device that provides the interface into the Secure Enclave from outside of it?
1 reply →
Even more shocking that Germany - my country - leads the leaderboard with over ten times as much requests as the second place.
> One scenario would be somebody in an airport and security officials are searching your device under the Counter Terrorism Act
No, it's much broader than that. The UK is asking for a backdoor to your data and backups in the cloud, not on your device. Why bother with searching physical devices when they can just issue a secret subpoena to any account they want?
It's actually pretty amazing that Apple made ADP possible for the general public. This is the culmination of a major breakthrough in privacy architecture about ten years ago.
Traditionally you had to make a choice between end-to-end encryption and data recoverability. If you went with E2EE, it's only useful if you use a strong password, but if you forget it then Apple can't help you recover your account (no password reset possible). So that was totally unsuitable for precious memories like photos for the average user.
Apple's first attempt to make this feasible was a recovery key that you print out and stuff in a drawer somewhere. But you might lose this. The trusted contact feature is also not totally reliable either, because chances are it's your spouse and they might also lose their device at that same time as you (for example in a house fire).
So while recovery keys and trusted contacts help, the solution that really made the breakthrough for ADP was iCloud Keychain Backup. This thing is low-key so cool and kind of rips up the previous assumptions about E2EE.
iCloud Keychain Backup makes it possible to recover your data with a simple, weak 6 digit passcode that you are virtually guaranteed never to forget, yet you are also protected from brute force attacks on the server. It is specifically designed to work on "adversarial clouds" that are being actively attacked. This is... sort of not supposed to be possible in the traditional thinking. But they added something called hardware security modules to limit the number of guesses an attacker can make before it wipes your key.
And crucially it ensures you don't forget this passcode because it's your device passcode which the OS keeps in sync with the backup key. This is part of the reason your iPhone asks you to enter your passcode now and then even though your biometrics work just fine.
It is a true secret that only you know and can keep in your brain even when your house burns down and nobody (hopefully) can derive from something they can research about you. This didn't really exist for the general populace until smartphones came along. And that ultimately was the breakthrough that allowed for changing the conventional wisdom on E2EE.
iCloud Keychain Backup came out about a decade ago and it has taken this long to gradually test the feasibility of going 100% E2EE without significantly risking customer data loss. The UK is kind of panicking but when people see how well ADP protects their most personal data from breaches, I think they will demand it. It just wasn't practical before.
> No, it's much broader than that. The UK is asking for a backdoor to your data and backups in the cloud, not on your device. Why bother with searching physical devices when they can just issue a secret subpoena to any account they want?
My point was that there was already a clear chain in place that would give them access to the data of foreign nationals. It's not just a "UK problem", but actually the ramifications are further reaching.
Another thing to consider is that these cookie alerts on sites were for EU countries only, but ended up everywhere. If Apple were to comply, this cloud backdoor could end up in other countries too, with the keys sitting there ready for collection.
To make things more complex still, they would need to support dual/multi nationality. It probably ends up looking like a dual key E2E system where there is a unique key for the end-user and then a third party. Key revocation would likely be difficult, so it would likely be the cloud provided decrypting and re-encrypting the files per request, throwing E2E out the window entirely.
Your Android and Microsoft backup aren't encrypted. They are already fair game for a warrant.
Your smartphone cannot be considered a private device. You as the owner don’t have sufficient control over its operating system and applications to ever make that claim.
In theory you have the likes of the PinePhone where you can run a full Linux kernel [1]. You could then use something like Waydroid to run Android apps [2].
I think the biggest concern is that many of the important apps are anti-emulation, for example banking apps and authentication apps.
[1] https://pine64.org/devices/pinephone_pro/
[2] https://waydro.id/
how much distance between
1) tech monopoly strong enough to stand up to G7 nation state demands
2) tech monopoly strong enough to remove itself from G7 nation state jurisdiction?
edit: s/monopoly/empire, apologies
It's amusing to think of Apple as a "monopoly" (if anything they have a monopsony on TSMC production) but let's just replace that with "giant" for purposes of discussion.
Tech giants typically devolve local operations to small companies to avoid liability - think petroleum suppliers not owning gas stations (because those typically end up as superfund sites). Not sure if this analogy this works for Google Android and all the manufacturers that deploy it for their smartphones too.
So corporations have been doing this forever, trying to find legal loopholes where they can have their cake and eat it too.
1 reply →
Apple is not a monopoly.
> There's no time limit on when you may be searched, so all people who ever travelled through British territory could be searched by officials.
> Let that sink in for a moment. We're talking about the largest back door I've ever heard of.
Codename 'Krasnov' is the largest backdoor I have ever heard of. And, we only need to look at his behavior.
These E2EE from USA can be tainted in so many ways, and FAMAG sits on so much data, that codename 'Krasnov' can abuse such to target whoever he wants in West. Because everyone you know is or has been in ecosystem of Apple, Google, or Microsoft.
Whataboutism! Fair. From my PoV, as European, the UK government is (still) one of the good guys who will protect Europe from adversaries such as those who pwn codename 'Krasnov'. Such protection may come with a huge price.
> We're talking about the largest back door I've ever heard of.
Meh, I don't know. I can still decide to not go the UK and be fine. I think the CLOUD Act is much worse because it's independent from where I am.
Feels like marvel was onto something with captain america and winter soldier.
The real prescient threat in that movie was the predictive AI algorithm that tracked individual behaviors and identified potential threats to the regime. In the movie they had a big airship with guns that would kill them on sight, but a more realistic threat is the AI deciding to feed them individualized propaganda to curtail their behavior. This is the villain's plot in Metal Gear Solid 2, which is another great story.
This got me thinking about MGS2 again and rewatching the colonel's dialogue at the end of the game: https://www.youtube.com/watch?v=eKl6WjfDqYA
> Your persona, experiences, triumphs, and defeats are nothing but byproducts. The real objective was ensuring that we could generate and manipulate them.
It's really brilliant to use a video game to deliver the message of the effectiveness of propaganda. 'Game design' as a concept is just about manipulation and hijacking dopamine responses. I don't think another medium can as effectively demonstrate how systems can manipulate people's behavior.
Life is imitating too many dystopian books, movies, etc these days. I think we need to put an end to all creative works before the timeline becomes irrecoverably destroyed.
5 replies →
It's always hilarious to see how far people here are ready to go to twist some bad Apple news into something which might be considered good.
I mean seriously. Apple making a stand? What stand? They are ripping security out of their customers hands. Customers which are already dependent on the company's decision in their locked in environment.
There is absolutely nothing good about it, and you dragging Android into it and making it look like it's even worse is suspicious. You can have full control over your Android device. Something impossible on an Apple phone. You can make your Android device safer than your iPhone.
There is an upside (if you trust them) -- they're pulling a feature rather than adding a back door to it. Supposedly, anyway.
1 reply →
The government forced them to pull the feature. Would you rather they left a toggle-switch that doesn't actually do anything? Or are you thinking they should just pull out of the EU altogether?
7 replies →
What I fund 'amusing' is the swap between Left vs Right.
'Back in the day' it was the "Right" that wanted have total access/total control over everything. So people turned a bit "left". Now the "Left" government is seeking totalitarian-style control ('because paedophiles/drugs/etc.).
As a reminder, both Right and Left extremes went from 'liberal/conservatives' to "we don't need elections ever again - trust me!".
I saw this happening in the US, in Saudi (e.g. Blackberry 'keys'). Now I see it in the UK. So I interpret this in two ways: 1) The "Left is the new Right" (or "Right is the new Left") 2) Left and Right are irrelevant terms when it comes down to "we need to exert control over people/knowledge/data/information/etc. And the 'guise' of Left/Right is just on the fiscal policies. So UK has been playing around with 'snooper charter' but at 'that' time Apple's encryption was not on the table.
Apple (I don't blame them - very much - just a little) does what a company does. Makes money. And they prefer to sell-out the data of their clients and keep their money, than lose that money.
So... yeah.. if your data is in someone else's server, that happens.
>> 'Back in the day' it was the "Right" that wanted have total access/total control over everything.
It was the Clinton administration that pushed for the Clipper chip.
Are you talking about a 'day' before that time?
If you go too far right or left, both types of authoritarianism are difficult to distinguish. I think this just makes the case that every election you need to be a swing voter, make sure your politicians still overlap with your ideals.
Apple today appear to be on the 'correct side of history', but even then you need to be swing consumer.
And now imagine for a second that the only thing the UK is doing here is getting the same direct access that the US (NSA) has already had for decades.
> the largest back door I've ever heard of.
Do you know of the clipper chip? https://en.wikipedia.org/wiki/Clipper_chip
From what I recall, we were only spared from it by someone hacking it before it was deployed.
> What concerns me more is that Apple is the only company audibly making a stand.
They are not making a stand. They roll over without a peep. And this is concerning users' privacy which they say is the core of the company.
Compare it to fighting every government tooth and nail over every single little thing concerning the "we don't know if it's profitable and we don't keep meeting records" AppStore
"Not making a stand" would be leaving everything as is, and handing your encryption keys over to the government. By loudly disabling ADP and saying this feature is illegal in the UK (they really should have said "illegal" instead of "unavailable" so people would know it was the government), they are at least making half a stand. By leaving it enabled in other regions and for visitors from other regions to the UK, they're making three quarters of a stand.
3 replies →
“ They roll over without a peep.”
What are you talking about? This is literally them doing the opposite, and there are multiple other public instances of them making a stand, not to mention in the design of their systems.
Truly curious how you see this that way.
3 replies →
Fundamentally, I think the issue is more about technical literacy amongst the political establishment who consistently rely on the fallacy that having nothing to hide means you have nothing to fear. Especially in the UK which operates as a paternalistic state and enjoys authoritarian support across all parties.
On the authoritarianism: these laws are always worded in such a way that they can be applied or targeted vaguely, basically to work around other legislation. They will stop thinking of the children as soon as the law is put into play, and it's hardly likely that pedo rings or rape gangs will be top of the list of priorities.
On the technical literacy: the government has the mistaken belief that their back door will know the difference between the good guys (presumably them) and the bad guys, and the bad guys will be locked out. However, the only real protection is security by obscurity: it's illegal to reveal that this backdoor exists or was even requested. Any bad guy can make a reasonable assumption that a multinational tech company offering cloud services has been compromised, so this just paints another target on their backs.
I've said it before, but I guarantee that the monkey's paw has been infinitely curling with this, and it's a dream come true for any black or grey hat hacker who wants to try and compromise the government through a backdoor like this.
It's not literacy. They don't care. They need control, and if establishing control means increased risks for you, it's not something they see as a negative factor. It's your problem, not theirs.
The government put in restrictions against using certain powers in the Investigatory Powers Act to spy on members of parliament (unless the Prime Minister says so, section 26), so I think they're just oblivious to the risk model of "when hackers are involved, the computer isn't capable of knowing the order wasn't legal".
https://www.legislation.gov.uk/ukpga/2016/25/section/26
10 replies →
They don't even need control. They want control. Why? Either they're idiots who think they need control or they are tyrants who know they'll need control later on when they start doing seriously tyrannical things.
6 replies →
Agreed.
I used to think it was illiteracy, but when you hear politicians talk about this you realise more often than not they're not completely naive and can speak to the concerns people have, but fundamentally their calculation here is that privacy doesn't really matter that much and when your argument for not breaking encryption based around the right to privacy you're not going to convince them to care.
You see a similar thing in the UK (and Europe generally) with freedom of speech. Politicians here understand why freedom of speech is important and why people some oppose blasphemy laws, but that doesn't mean you can just burn a bible in the UK without being arrested for a hate crime because fundamentally our politicians (and most people in the UK) believe freedom from offence is more important than freedom of speech.
When values are misaligned (safety > privacy) you can't win arguments by simply appealing to the importance of privacy or freedom of speech. UK values are very authoritarian these days.
opinion: any government that "needs" such control, is an enemy of the people and must be abolished, and anyone can morally and ethically do so
5 replies →
"Especially in the UK which operates as a paternalistic state and enjoys authoritarian support across all parties."
What is a "paternalistic state". I studied Latin so obviously I understand pater == father but what is a father-like state?
What on earth is: "authoritarian support across all parties".
The UK has one Parliament, four Executives (England, Northern Ireland, Scotland, Wales) and a Monarch (he's actually quite a few Monarchs).
Anyway, I do agree with you that destroying routine encryption is a bloody daft idea. It's a bit sad that Apple sold it as an extra add on. It does not cost much to run openssl - its proper open source.
In medicine, a paternalistic attitude towards the patient from a point of authority (like a father) The doctor acts as if he knows more and knows what is better. The patient has his own preferences and priorities, but they don't necessarily match with what the doctor does.
I suppose a paternalistic state functions to satisfy the needs of the people, and to define those needs. The people get what the state says is best for them.
Paternalism, unless I'm mistaken, is a belief among those in power that they what's best for you, better than you do, and will exercise power on your behalf in that manner. Just like your parents do when you're a child.
Government knows what’s best for the people (colloquially we call it the nanny state).
All our main political parties have an authoritarian slant so these policies have rarely received long-lasting opposition. Literally every government in office for the past 30-odd years has presented legislation like this.
Are you trying to disagree with them by pretending that they're speaking rubbish? As a Brit, their comment made complete sense to me.
By the way, there is no 'England' executive; it's the government of the United Kingdom, which handles all matters not devolved, in England and the rest of the UK.
> that having nothing to hide means you have nothing to fear
hopefully the US turning from leader of the free world to Russia's tool will give them the kick they need to realise that just because you trust the government now doesn't mean you trust the next government or the one after it.
You probably don't want to look up which US President tried to force Apple to insert an encryption back door into iPhones back in 2015.
However, Google did only start moving to protect location data from subpoenas after people started to worry that location data could be used as a legal weapon against women who went to an abortion clinic, so your larger point stands.
8 replies →
> hopefully the US turning from leader of the free world to Russia's tool
So much humour in one short phrase.
Do you really believe your propaganda or is it just absentmindedly parroting pro permanent war talking points?
7 replies →
What the politicians want is partial security: something they can crack but criminals can't. That is achievable in physical security, but not in cybersecurity.
I have a feeling the politicians already know partial cybersecurity isn't an option, and don't care. Certainly, the intelligence community advising them absolutely does know. We don't even have to be conspiratorial about it: their jobs are easier in the world where secrets are illegal than in the world where hackers actually get stopped.
> That is achievable in physical security, but not in cybersecurity.
Not with physical security either, I'm afraid.
2 replies →
> That is achievable in physical security, but not in cybersecurity
This isn't accurate though, and leads us down the path of trying to prevent these bad laws from a technical perspective when we should be fighting the principle of the bad law not just decrying it for being "unworkable".
It is possible to construct encryption schemes with a "backdoor key" while still being provably secure against anyone else.
This creates precisely the "partial security" you describe: Criminals can't crack the encryption, but the government can use their backdoor-key.
But like those who argue online age-consent schemes can't work, it doesn't help to argue against the technical aspects of such bad laws. The law, particularly UK law, doesn't care for what's technically possible. The bad laws can sit on the books regardless of the technical feasibility of enforcement. Eventually technology can catch up, or the law can simply be applied on a best endeavours / selective enforcement approach.
3 replies →
> the government has the mistaken belief that their back door will know the difference between the good guys (presumably them) and the bad guys
This is a very good point, and in the recent months we have been witnessing that people in government, or aiming to become the government, are definitely not the good guys. So, even if what they are asking would be limited to just governments (which it wouldn't), they can't claim they are the good guys anymore.
Furthermore, one UK head of state call everyone supporting encryption pedophiles
https://x.com/BenWallace70/status/1892972120818299199
Just to be clear: Wallace is not a head of state, or even an MP any more. At one point, he was Secretary of State for Defence, a Cabinet position, however he resigned this in 2023.
This doesn’t justify his position (it’s stupid) but he doesn’t speak for the current government.
8 replies →
And that's why it is so important to nip this "pedo" / "think of the children" crap right in the bud.
Obviously pedos on the interwebs are bad, but hey as long as it's just anime they're whacking off to I don't care too much. But the real abuse, that's done by - especially in the UK - rich and famous people like Jimmy Savile. And you're not gonna catch these pedos with banning encryption, that's a fucking smokescreen if I ever saw one, you're gonna catch them with police legwork and by actually teaching young children about their bodies!
5 replies →
https://xcancel.com/BenWallace70/status/1892972120818299199
1 reply →
> one UK head of state
What on earth are you talking about?
Charles III is head of state, and before that, Liz II. The monarch absolutely does not get involved in politics.
3 replies →
Ironic.
[dead]
"it's hardly likely that pedo rings or rape gangs will be top of the list of priorities".... is this not one of the most disturbing, disgusting, psychologically troubling and damning ideas ever to be put to words/brought to awareness? . Right up there "let's meticulously plan out this horrific, atrocious, dehumanizing act and meditate upon the consequences, and then choose the most brutal and villainous option". Dear Lord....
People are extremely opposed to pedos, so they're a primary rationalization for oppressive technology. But then you have two problems.
First, pedos know everybody hates them, so they take measures normal people wouldn't in order to avoid detection, and then backdooring the tech used by everybody else doesn't work against them because they'll use something else. But it does impair the security of normal people.
Second, there aren't actually that many pedos and the easy to catch ones get caught regardless and the hard to catch ones get away with it regardless, which leaves the intersection of "easy enough to catch but wouldn't have been caught without this" as a set plausibly containing zero suspects. Not that they won't use it against the ones who would have been caught anyway and then declare victory, but it's the sort of thing that's pretty useless against the ones it's claimed to exist in order to catch, and therefore not something it can be used effectively in order to do.
Whereas industrial espionage or LOVEINT or draining grandma's retirement account or manipulating ordinary people who don't realize they should be taking countermeasures -- the abuses of the system -- those are the things it's effective at bringing about, because ordinary people don't expect themselves to be targets.
> is this not one of the most disturbing, disgusting, psychologically troubling and damning ideas ever to be put to words/brought to awareness? .
Hmm? Hell has depths. Your yard might be a little too short to measure them? In that case, just think about this: rape is probably most common in prisons, where you will send innocents the moment this dragnet thing glitches.
> technical literacy amongst the political establishment who consistently rely on the fallacy that having nothing to hide means you have nothing to fear.
That's an awfully generous assessment on your part. Kindly explain just what "technical literacy" has to do with the formulation you note. From here it reads like you are misdirecting and clouding the -intent- by the powerful here.
Also does ERIC SCHMIDT an accomplished geek (who is an official member of MIC since (during?) his departure from Sun Microsystems) suffers from "technical literacy" issues:
https://news.ycombinator.com/item?id=983717
Thank you in advance for clarifying your thought process here. Tech illiteracy -> what you got to hide there buddy?
I feel like the comment was clear, technical illiteracy leads politicians to believe that they'll be the only ones with access to this backdoor, which isn't true.
4 replies →
Let me offer a possible example that might be more in line with the HN commenting guideline about interpreting people's comments as charitably as reasonably possible:
My password manager vault isn't exactly something to hide in the political sense, but it's definitely something I would fear is exposed to heightened risk of compromise if there were a backdoor, even one for government surveillance purposes. And it's a reasonable concern that I think a lot of people aren't taking seriously enough due, in part, to a lack of technical literacy. Both in terms of not realizing how it materially impacts everyday people regardless of whether they're up to no good, and in terms of not realizing just how juicy a target this would be for agents up to and including state-level adversaries.
As for Eric Schmidt, he's something of a peculiar case. I don't doubt his technical literacy, but the dude is still the head of one of the world's largest surveillance capitalist enterprises, and, as the saying goes, "It is difficult to get a man to understand something when his salary depends on his not understanding it."
> Especially in the UK which operates as a paternalistic state and enjoys authoritarian support across all parties.
This seemed strange to point out. It’s not really any more or less “paternalistic” than most western nations including the US.
Folks in the United States aren't routinely arrested for Facebook posts.
11 replies →
If you see a red car driving down the street do you not call it red because there are many other red cars? They're adding color (pun intended) to their description of the general bias of the UK government. What you're doing is called Whataboutism - the argument that others are doing something similar or as bad in different contexts. It doesn't make what the UK is doing any less bad for citizens (and non-citizens) privacy or data sovereignty.
1 reply →
Many people might not be aware of it, but Apple publishes a breakdown of the number of government requests for data that it receives, broken down by country.
The number of UK requests has ballooned in recent years: https://www.apple.com/legal/transparency/gb.html#:~:text=77%...
Much of this is likely related to the implementation and automation of the US-UK data access agreement pursuant to the CLOUD Act, which has streamlined this type of request by UK law enforcement and national security agencies.
Looking at the ones for Germany, those seem like rookie numbers
https://www.apple.com/legal/transparency/de.html#:~:text=77%...
It's also comparatively worse than the raw numbers suggest because the customer base of Apple phones in Germany is much smaller than in the UK.
2 replies →
The problem is AFAIK this act is a lot different and Apple or any party that gets this order is completely forbidden to talk about it. So these kind of requests would not show up in this transparency requests. It is IMHO fair to assume Apple will UK this backdoor given they chose to disable Advanced Data Encryption and public would have no insight to amount and reasons to the backdoor usage. It is really troubling.
I don't share your findings, EVERY six-month period between January 2014 - June 2017 shows bigger requests than any six-month period in the last 5 years.
Sad to see the home of the magna carta slowly spiraling down into fascism and 1984. The government should be required to have a specific warrant to get at your personal data.
That is such a self serving comment. If Apple provides UK a backdoor, it weakens all users globally. With this they are following the local law and the country deserves what the rulers of the country want. These experts are a bit much. In the next paragraph they say something ominous.
It's also just false. Google pulled out of China many years ago because they didn't want to bow to the Chinese government's demands.
And they didn't just withdraw a product, they withdraw their entire business.
I wonder what the impact of Apple withdrawing from China will be. I know we are talking about UK, but this made me think.
Not only their sales will reduce, but hey Chinese manufacturing cuts down. By how much? Will it be impactful? I would think so but wonder if it is quantifiable.
7 replies →
Fake privacy experts like Caro Robson need to be held accountable.
I often notice journalistic pieces interview people and then use maybe 30 seconds' worth of material from a 20-minute interview. The "expert" could have condemned it in any number of ways until the topic of applying data protection laws came up and she said that companies need to be held accountable (could be about GDPR, could be about snooping laws) which the journalist then quoted, not out of malice but because everyone already condemns it and this is the most interesting statement of the interview
Anyway, so while I don't think we should condemn people based on such a single quoted sentence... I took a look at her website and the latest video reveals at 00:38 that she worked for the UK crime agency, which does sound like the one of the greatest possible conflicts of interest for someone called upon for privacy matters rather than crime fighting. Watching the rest of that interview, she approaches it fairly objectively but (my interpretation of) her point of view seems to be on the side of "even with this backdoor, a warrant needs issuing every time they use it and so there's adequate safeguards and the UK crime fighters and national security people should just get access to anything they can get a warrant for"
1 reply →
This is actually an increasing concern, that large multinational companies are so powerful that they don't have to obey governments any more, and can instead blackmail them by withdrawing products. Pornhub has done this in US states. Meta has threatened to do it in various countries. There has always been pushback to regulation from powerful companies, but punishing countries by withdrawing products seems to be used as a tactic more often recently. There are other tools of power companies use as well, like deciding where to create jobs and build facilities. Musk has used that, moving from California to Texas. Defence and oil companies use these tactics also.
I disagree but respect your opinion. Companies have the right to free speech. In the tussle between regulators and companies, companies are disadvantaged. If we can force companies to do the regulators bidding and not allow them to use free speech to act in their best interests, we would have global tyranny. The regulators and companies both acting towards their own goals with freedom allows us to have a world with balance.
I believe in this however I think we are testing limits of this approach with scenarios like the one with encryption. Ideally privacy needs E2E encryption. But concerns on misuse of such technology that governments raise are also not without merit. I wonder if this tussle between regulators and companies can end in any way in which privacy is not compromised. Mathematically it doesn't seem that there is a way to be safe and private.
1 reply →
Google News pulling out of Spain..
>Online privacy expert Caro Robson
Ironic to refer to her as a "privacy expert" given her open hostility to privacy.
Governments forcing companies from other countries to do business in their country seems like the worrying precedent to me.
>"It would be a very, very worrying precedent if other communications operators felt they simply could withdraw products and not be held accountable by governments,"
This would actually be a very very very very VERY GOOD precedent if you ask me.
Facebook pulled something similar when Canada passed the Online News Act and instead of extorting facebook to pay the media companies for providing a service to them (completely backasswards way to do things), they just pulled news out of Canada. I despise Meta as a company, but I had to give them credit for not just letting the government shake them down.
Good riddance. Governments need to be reminded from time to time that they are, in fact, not Gods. We can and should, just take our ball and go play in a different park or just go home rather than obey insane unjust laws.
I love their products: whatsapp and facebook
1 reply →
"a product" and "cooperate" are doing so much work in that statement that they collapsed and look like ________ and ________
They re-emerged as "security feature" "add vulns to security features to make it an insecurity feature"
Note that this doesn’t satisfy the government’s original request, which was for worldwide backdoor access into E2E-encrypted cloud accounts.
But I have a more pertinent question: how can you “pull” E2E encryption without data loss? What happens to those that had this enabled?
Edit:
Part of my concern is that you have to keep in mind Apple's defense against backdooring E2E is the (US) doctrine that work cannot be compelled. Any solution Apple develops that enables "disable E2E for this account" makes it harder for them to claim that implementing that would be compelling work (or speech, if you prefer) if that capability already exists.
When you disable ADP, your local encryption keys are uploaded to Apple's servers to be read by them.
Apple could just lock you out of iCloud until you do this.
That’s exactly the plan. Anyone with this enabled in the UK will need to manually disable it or they’ll get locked out of their iCloud account after a deadline.
1 reply →
The hardware will not allow this, at least not without modifications. The encryption keys are not exportable from the Secure Enclave, not even to Apple's own servers.
7 replies →
> how can you “pull” E2E encryption without data loss
You can’t. The article says if you don’t disable it (which you have to do yourself, they can’t do it for you, because it’s E2E), your iCloud account will be canceled.
At this point, the right thing to do is allow for an alt-service.
6 replies →
We are told the encryption keys reside only on your device. But Apple control “your” device so they can just issue an update that causes your device to decrypt data and upload it.
Apple has already fought US government demands that they push an update that would allow the US governmrnt to break encryption on a user's device.
> In 2015 and 2016, Apple Inc. received and objected to or challenged at least 11 orders issued by United States district courts under the All Writs Act of 1789. Most of these seek to compel Apple "to use its existing capabilities to extract data like contacts, photos and calls from locked iPhones running on operating systems iOS 7 and older" in order to assist in criminal investigations and prosecutions. A few requests, however, involve phones with more extensive security protections, which Apple has no current ability to break. These orders would compel Apple to write new software that would let the government bypass these devices' security and unlock the phones.
https://www.wikipedia.org/wiki/Apple%E2%80%93FBI_encryption_...
Would just upload the keys
13 replies →
Apple do not remotely control devices, and automatic updates are not mandatory.
I think Prof Woodward's quote in the article will likely hold true for Apple's response to the original UK government request:
"It was naïve of the UK government to think they could tell a US technology company what to do globally"
Apple is in a really tough position. I don't know if there's any way they could fulfil the original request without it effectively becoming a backdoor. Disabling E2E for the UK market is just kicking the can down the road.
Even simply developing a tool to coerce users out of E2E without their explicit consent to comply with local laws could be abused in the future to obtain E2E messages with a warrant on different countries.
A very difficult position to be in.
> Apple is in a really tough position.
You mean Apple is in a unique position to make a statement. No more Apple products in the UK. Mic drop. Exit stage left.
2 replies →
Or, this is how they save face with their customers having complied with the request rather than stop trading with the UK.
> Any solution Apple develops that enables "disable E2E for this account" makes it harder for them to claim that implementing that would be compelling work (or speech, if you prefer)
I think it’s really speech [0], which is why it’s important to user privacy and security that Apple widely advertises their entire product line and business as valuing privacy. That way, it’s a higher bar for a court to cross, on balance, when weighing whether to compel speech/code (& signing) to break E2EE.
After all, if the CEO says privacy is unimportant [1], maybe compelling a code update to break E2EE is no big deal? (“The court is just asking you, Google, to say/code what you already believe”).
Whereas if the company says they value privacy, then does the opposite without so much as a fight and then the stock price drops, maybe that’d be securities fraud? [2]. And so maybe that’d be harder to compel.
[0]: https://www.bloomberg.com/opinion/articles/2019-06-26/everyt...
The iOS screenshot displays a message saying it's no longer available for new users.
> the (US) doctrine that work cannot be compelled
Is this actually a thing? Telecoms in the US are compelled to provide wiretap facilities to the US and state and local governments.
>> Apple's defense against backdooring E2E is the (US) doctrine that [government can’t] be compelling work (or speech, if you prefer)
It’s really not "work” but speech. That’s why telecoms can be compelled to wiretap. But code is speech [2], signing that code is also speech, and speech is constitutionally protected (US).
The tension is between the All Writs Act (requiring “third parties’ assistance to execute a prior order of the court”) and the First Amendment. [1]
So Apple may be compelled to produce the iCloud drives the data is stored on. But they can’t be made to write and sign code to run locally in your iPhone to decrypt that E2EE data (even though obviously they technologically could).
[1]: https://www.eff.org/deeplinks/2015/10/judge-doj-not-all-writ...
[2]: https://www.eff.org/deeplinks/2015/04/remembering-case-estab...
1 reply →
> how can you “pull” E2E encryption without data loss? What happens to those that had this enabled?
They'll keep your data hostage and disable your iCloud account. Clever, huh? So they are not deleting it, just disabling your account. "If you don't like it, make your own hardware and cloud storage company" kind of a thing.
More like "If you don't like it, talk to your local politicians", which is, IMO, a totally valid approach.
1 reply →
> But I have a more pertinent question: how can you “pull” E2E encryption without data loss? What happens to those that had this enabled?
Well exactly. The UK just showed the whole thing is a joke and that Apple can do this worldwide.
Think about it.. You don't even have to be an Apple user to be affected by this issue. If someone backs up their conversations with you to apple cloud, your exchange is now fair game. You get no say in it either.
We all lose.
That's why it's important to use apps like Signal where you can set the retention of your messages. I've got everybody I know using it now!
Setting a retention time out is playing with fire. If the police get ahold of the other party's device, and present an exhibit which they say contains the true conversation, you could be worse off than if you retained the conversation. The fact that you have since deleted it could be incriminating.
In some jurisdiction, yes, legally, such evidence might not be probative, but you might still convicted because of it.
9 replies →
Given historical backups are the norm here, retention only does so much.
Really, apps should encrypt their own storage with keys that aren't stored in the backups. That's how you get security/privacy back.
3 replies →
I use a patched Signal client that disables retention deletion and remote delete messages.
2 replies →
In a world where they cancel encryption they can't access... doesn't Signal and its CIA funded origins concern you?
5 replies →
Very similar to sites like LinkedIn, which ask you to share your personal info & contact list.
I don't want to share my contact details, but the second someone I know decides to opt in, I lose all rights to my own data as they've shared it on my behalf.
Maybe they have other info, such as birthday, home address, other emails or phone #s, etc. stored for me, which is all fair game, as well.
If you are in EU, request your data be redacted.
Security hinges on trust. The only real privacy tool is PGP which uses a web of trust model. But it only works if people own their own computers and storage devices. What they've done is got everyone to rent their computers and storage instead. There's no security model that works for the users here.
Scary - I try to use signal as much as possible now for this reason.
Signal can't evade this law either.
3 replies →
> Online privacy expert Caro Robson said she believed it was "unprecedented" for a company "simply to withdraw a product rather than cooperate with a government".
> "It would be a very, very worrying precedent if other communications operators felt they simply could withdraw products and not be held accountable by governments," she told the BBC.
Attributing this shockingly pro-UK-spy-agencies quote to an "online privacy expert" without pointing out she consults for the UN, EU and international military agencies is typical BBC pro-government spin. In fact, Caro, it would be "very, very worrying" if communications operators didn't withdraw a product rather than be forced to make it deceptive and defective by design.
Free speech already under threat and now y'all are giving up the right of private communication too? For anyone cheering this on, do you honestly think this will only affect the "bad people", and you'll never have your own neck under the government's boot? Even if you trust the government today, what happens when your neighbors elect a government you disagree with ideologically?
I don’t think anyone is cheering this on.
Many people do, unfortunately, so long as it's framed as "only terrorists and pedophiles need encryption that cops can't break".
2 replies →
Instead of the word cheering we could use letting.
Bad people flourish over the inaction of good people.
(but yes, there are always several who protect and argue for things risking their own and everyone's livelihood, exposing themselves to shady elements, along singled out and elevated thin aspects, cannot understood why)
Most politicians are.
[dead]
[dead]
I have a naive question, and it's genuine curiosity, not a defence of what's happening here.
This ADP feature has only existed for a couple of years, right? I understand people are mad that it's now gone, but why weren't people mad _before_ it existed? For like, a decade? Why do people treat iCloud as immediately dangerous now, if they didn't before?
Did they think it was fully encrypted when it wasn't? Did people not care about E2E encryption and now they do? Is it that E2E wasn't possible before? If it's such a huge deal to people now, why would they have ever used iCloud or anything like it, and now feel betrayed?
I guess I'm one of the people who was upset that it didn't exist before, and I didn't enable iCloud Backup as a result. I didn't use iCloud Photos. I had everything stored on a NAS (which was in-fact encrypted properly) and used a rube goldberg-esque setup to move data to it periodically. I used iMazing and local encrypted backups on a schedule.
Lots of people called for E2EE on this stuff, but let's be real about one thing: encryption as a feature being more accessible means more people can be exposed to it. Not everyone can afford a rube goldberg machine to backup their data to a NAS and not make it easily lost if that NAS dies or loses power. It takes immense time, skill, and energy to do that.
And my fear isn't the government, either, mind you. I simply don't trust any cloud service provider to not be hacked or compromised (e.g., due to software vulnerability, like log4j) on a relatively long timescale. It's a pain to think about software security in that context.
For me, ADP solves this and enables a lot of people who wouldn't otherwise be protected from cloud-based attacks to be protected. Sure, protection against crazy stuff like government requests is a bonus, but we've seen with Salt Typhoon that any backdoor can be found and exploited. We've seen major exploits in embedded software (log4j) that turn out to break massive providers.
So, there were people upset, their concerns were definitely voiced on independent blogs and random publications, and now, we're back in the limelight because of the removal of the feature for people in the UK.
But, speaking as a user of ADP outside of the UK, I am happy that ADP is standing up for it, and thankful that it exists.
(To be clear: government backdoors, and government requests also scare me, but they aren't a direct threat to myself as much as a vulnerability that enables all user data to be viewed or downloaded by a random third-party).
Many of us were very upset about Apple's slow-rolling this feature. There were many claims that they delayed the rollout due to government pressure [1] (note: that story is by the same reporter who broke today's news a couple of weeks ago.)
Rolling out encryption takes time, so the best I can say is "finally it arrived," and then it was immediately attacked by the U.K. government and has now been disabled over there. I imagine that Apple is also now intimidated to further advertise the feature even here in the U.S. To me this indicates we (technical folks) should be making a much bigger deal about this feature to our non-technical friends.
[1] https://www.reuters.com/article/world/exclusive-apple-droppe...
At one point in time, the entirety of web communication was completely unencrypted.
Why were people not mad then? Do you think people would be angrier now, if HTTPS were suddenly outlawed?
Among other valid answers, removing rights and privileges generally makes people angrier than not having those rights or privileges in the first place.
> Why were people not mad then?
Oh, we were. I am in the crowd who had been asking for generally used encryption since 1995. After all, we were already using SSH for our shell connections.
The first introduction to SSL outside of internet banking and Amazon was for many online services to use encryption only for their login (and user preferences) page. The session token was then happily sent in the clear for all subsequent page loads.
It took a while for always-on encryption to take hold, and many of the online services complained that enabling SSL for all their page loads was too expensive. Both computationally and in required hardware resources. When I wrote for an ICT magazine, I once did some easy benchmarking around the impact of public key size for connection handshakes. Back then a single 1024-bit RSA key encryption operation took 2ms. Doubling it to 2048 bits bumped that up to 8ms. (GMP operations have O(n^2) complexity in terms of keysize.)
1 reply →
Counterpoint: when web communication was unencrypted it was before we did our banking, tax filing, sent medical records, and sent all other kinds of sensitive information over the internet. The risks today are not remotely the same as they once were.
1 reply →
always used my own encryption and cyphered any sensitive data/communications, but the problem is that most people won't and you're often compromised by them
simple solutions like Whatsapp, Signal and ADP brought this to the masses - which some governments have issues about - and this makes a massive difference to everybody including those who wouldn't be caught dead using an iphone anyway
if we could go back to the early 1990s when only professionals, Uni students, techies and enthusiasts used the internet I'd go in a heartbeat but that's not the world we're living in
You've always been able to perform encrypted backups to your own local PC or Mac out of the box, so people who do care about privacy have always had that option.
One thing I've found concerning is that Apple had encrypted cloud backups ready to roll out years ago, but delayed releasing the feature when the US government objected.
> After years of delay under government pressure, Apple said Wednesday that it will offer fully encrypted backups of photos, chat histories and most other sensitive user data in its cloud storage system worldwide, putting them out of reach of most hackers, spies and law enforcement.
https://www.washingtonpost.com/technology/2022/12/07/icloud-...
So the UK government isn't the only government that has objected to users having real privacy protections.
Yes, I was mad before it existed and didn't use icloud backups. With the E2E and ADP I turned it on. If it gets nuked in the US I'll go back to encrypted local backups only.
People learn stuff over time. If you are not living like RMS you probably are allowing something to spy on you. If that spying gets removed you become aware. You don't want it back.
It is like anything that gets better. Fight for the better. It is like aviation safety: who cares about a few crashes this year when people didn't complain in the 70s.
A few factors
- e2e encryption is not ubiquitous yet, but awareness is ascending.
- distrust for government also is on the uptrend.
- more organized dissent to preserve privacy.
No people didn't assume data was encrypted.
Yes E2E has been possible for many decades, but businesses don't have privacy as a priority, sometimes even counter incentives to protect it. Personal data sells well.
Things have changed because more people are getting to understand why it matters, forcing the hand of companies having to choice but at least feign to secure privacy.
An E2E encrypted thing that later gets a special backdoor added is obviously much worse than a not E2E encrypted thing.
It's like when google suddenly decided that their on-device-only 2FA app Google Authenticator should get an opt-out unencrypted cloud backup.
It means people who don't pay a lot of attention can suddenly have much less protection than they were originally sold on.
Think most people had no idea how it worked, it was magic to them.
iCloud hacks (like in 2014) have raised awareness for the need for E2EE.
I was mad for years that ADP didn't exist / was being witheld due to Apple+FBI negotiations for years.
I 100% treated iCloud as dangerous until they released it, and I cheered in the streets when they finally did.
I think it is more about going backwards. It is often difficult to remove laws than to add them. This is a similar situation.
In this situation, I agree that it is bad day for personal privacy/security
iCloud and iPhones have traditionally resisted US governmental overreach, only giving data to iCloud in cases of actual criminal prosecution against specific individuals. As well, iPhone backups in iCloud is relatively new, as are many other arbitrary storage features — it used to just be your songs and your photos! Now it’s data from all of your apps and a full phone backup. Hence the resistance: the stories of police being unable to recover data from a locked iPhone may now be over
I think it makes sense for the services we rely on to get more secure as the world gets more dangerous. It's an arms race. You don't want to go back.
Apple has been advertising security and privacy as a top feature for years now. It would make sense for people to get upset if those features were removed.
People were mad. Remember the Snowden leaks and PRISM program from NSA? [1]
In fact, Apple began to adopt “privacy” first marketing due to this fallout. Apple even doubled down on this by not assisting FBI with unlocking a terrorist suspects Apple device in 2016. [2]
It was around that time I actually had _some_ respect for Apple. I was even a “Apple fanboy” for some time. But that respect and fanboi-ism was lost between 2019 and now.
Between the deterioration of the Apple ecosystem (shitty macOS updates), pushing scanning of photos and uploading to central server (CSAM scanning scandal?), the god awful “Apple wall”, very poor interoperability, and very anti-repair stance of devices.
[1] https://www.theguardian.com/world/2013/jun/06/us-tech-giants...
[2] https://money.cnn.com/2016/03/28/news/companies/fbi-apple-ip...
Hacker News is a small subsection of the internet. I think the majority of people, probably 90% or more, simply do not care that much.
Apple and the FBI were squabbling over this for a few years, and then Apple decided to end the conversation one day and implement ADP
The situation was not something existed since the beginning of time, it evolved gradually. Long ago not that much and not that many critically private data was circulating the net, it increased and got essential living online by time, in some instances forced in an increasing portion of situations. Worry then had no grounds yet. As exposure of the population grew, so did the benefit for adverse elements breaking online data stores, growing in numbers fast, not all made properly in the headless chase of success. Damage and hence awareness grew gradually.
But basically yes, people are stupid and gave no shit but believed all f nonsense, the marketing frauds made them eating up their crap happy if it had pretty words and pictures, promising something halfway to Paradise. Like the Cloud mirage. Those of careful personality were cautious since the first time Apple and alike pushed on people giving up control over their own data for tiny comfort (or no comfort eventually due to all hostile patterns in the full picture) not putting all and every precious or slightly valuable stuff to some unknown server on the internet protected only by hundreds of years old method: password (so not protected at all essentially). Memories, contacts, schedules, communications, documents, clone of their devices in full, putting all into 'cloud' (much before secure online storage became a thing)? Many times to the very same one? Who are that much idiots, really?!
iCloud did a lot less, in the past. Disabling it now gives you access to more data than it did a few years ago. And I also suspect it has far more users today than it did a few years ago.
i mainly use apple devices, but never put anything on icloud before adp came out.
The problem here is not with iCloud but with the U.K. government. People like to tell themselves the government isn’t actually trampling their rights but events like this make it impossible to ignore.
The nightmare continues. For now I am using 3rd party backup services that are (currently) promising me that my backups are encrypted by a key they do not have access to, or control over. But can this even be believed in an age where these secret notices are being served to any number of companies? I suppose the next step would be to ensure that files don't ever arrive in the cloud unencrypted, but I have yet to see a service that allows me to do this with the same level of convenience as, say, my current backup solution, which seamlessly backs up all my phones, my family members' phones, my laptops, their laptops etc. I depend on having an offsite backup of my data. Which inevitably includes my clients' data also. Which I am supposedly keeping secret from outside access. So how does that work once everything becomes backdoored?
In the case of the U.K., they can throw you in jail for not handing over your encryption key, so it’s a moot point. They’ve been slowly expanding this power for twenty years now.
Not for content in the cloud, as far as I understand. Someone will correct me, but you can be arrested and threatened with terror charges if you dont unlock your device, but this does not give them permission to access other computers via the internet.
1 reply →
ive been through all this with the law. no one ever got jailed for not handing over encryption keys unless they were a definitive criminal and theres strong evidence there is criminal data on the device.
they tried this with me (NCA) but the judge wouldnt sign off as they had nothning on me or my device. this did however REALLY want to access it! fuck them. pricks
6 replies →
Convenience usually comes at a cost. You shouldn't have to trust anyone. Just use a generic storage service and only upload encrypted files to it. Syncthing + Rclone will probably get you a similar setup that you control.
security and convenience are ever at war.
IMO the only thing you can have a high level of trust in is your own *nix server. Backup those devices to it then encrypt there before being sent to the cloud.
> your own *nix server
Just be sure it's pre-Intel Management Engine / pre-AMD Platform Security Processor!
Handling the encryption yourself is the way to go, but for maximum security, don't send that encrypted data to the cloud. Keep it all on your own server(s).
That doesn't help people who aren't technically capable, of course. But at least those who are can protect themselves.
3 replies →
[dead]
As a citizen, I don’t understand what the UK government thinks they are getting here - other than the possibility of leaks of the nation’s most sensitive data.
Also is it not possible to set up my Apple account outside of the UK while living here?
> other than the possibility of leaks of the nation’s most sensitive data
Amusing when you consider the National Cyber Security Centre (NCSC, a part of GCHQ), along with the Information Commissioners Office, both publish guidance recommending, and describing how to use, encryption to protect personal and sensitive data.
Our government is almost schizophrenic in its attitude to encryption.
> Our government is almost schizophrenic in its attitude to encryption.
Of course: it's not a monolithic entity. It's a composite of different parts that have different goals an interests.
6 replies →
I suppose they don't believe certain facts engineers are telling them. With Brexit it was coined "Project Fear". Now they're being told that adding backdoors to an encrypted service almost completely erodes trust in the encryption and, as in the case with Apple here, in the vendor. However, I suppose it is very hard to find objective facts to back this. I'd guess this is why Apple chose to both completely disable encryption and inform users about the cause.
Now we're probably just waiting for a law mandating encryption of cloud data. Let's see whether Apple will actually leave the UK market altogether or introduce a backdoor.
In the US, the NSA has always had both missions (protect our country’s data and expose every other country’s data). Since everyone uses the same technology nowadays, that’s a rather hard set of missions to reconcile, and sometimes it looks a little ridiculous. As of fairly recently, they have a special committee that decides how to resolve that conflict for discovered exploits.
Correct me if I'm wrong here, and maybe this is too charged for HN, but looking over at you guys from the US:
The US has problems (don't get me wrong, look at our politics, enough said); but the UK seems to be speedrunning a collapse. The NHS having patients dying in hallways; Rotherham back in the popular mind; a bad economy even by EU standards; a massive talent exodus (as documented even on HN regarding hardware engineers); a military in the news for being too run down to even help Ukraine; and most relevant to this story - the government increasingly acting in every way like it is extremely paranoid of the citizens.
Any personal thoughts?
18 replies →
That's because GCHQ knows they can kill if you refuse to decrypt so they have no problem suggesting it to you.
I mean, this is no different than one part of the government suggesting running laundry at night to reduce the environmental impact of energy use, while another suggests only running it while awake to reduce fire hazard. Governments and corporations rarely have complete internal alignment.
I don't know, they've definitely been cracking down on journalists over the past year. Could be an attempt to crack down harder / create a chilling effect
They've been sending people to prison for posting memes....
2 replies →
You need a valid payment method from that country and then cancel all current subscriptions and change to that new country/region.
You’ll probably want a method of downloading apps tied to the UK app store though - particularly banking apps.
btw, anyone know if this cancels Apple+ Support too? I’ve been resisting switching countries because I don’t want to lose that subscription since you can only subscribe within 60 days of device purchase.
> Also is it not possible to set up my Apple account outside of the UK while living here?
The ability to turn on Advanced Data Protection does seem to be tied to your iCloud region (as of now I can still turn it on, and I’m in the UK but have an account from overseas).
You need a non-UK card to use on your Apple Account to change its region.
Would a Wise card work?
2 replies →
full control on everyone they deem as an opponent. in UK being dimmed and oponent is about posting the wrong meme or even standing in the wrong street at the wrong moment.
It's for Labour "data analysts" to go through people photos and search for nudes.
[dead]
The UK is arresting people for posting memes. They want full control and that's it.
I'm sympathetic to the J.D. Vance angle, which is that European governments are increasingly scared of their own people. This is not doing a lot to change my mind.
Very wrong conclusions.
They are not scared of people, but of working, doing their job, especially when it is difficult (catching criminals). They expect the job to be done for them by others, on the expense of everyone, while they collecting all the praise.
On sympathetic to Vance I did not really found a presentable reaction, would not find on any other accidentally agreeable sentence leaving his mouth (very low chance btw.). Talking a lot about all kind of things sooner or later will hit something acceptable, which will not yield an unacceptable and destructive to society figure sympathetic.
You also should be aware of practices and conducts the various US security services practice (and probably all governemnts out there), if not from news or law but at least from the movies. When we come to the topic of who is afraid of their own.
Exactly, it's the same thing with the Chat Control law in the EU and it reminds me of the scene in the movie Office Space where the consultants are trying to figure out who is doing what in the company.
Basically instead of doing their jobs, the cops expect Apple, Meta et al to intercept all the data, then feed it into some kind of AI black box (not done by them but contracted out to someone else at the taxpayer's expense) that will then decide if you get arrested within the next 48H (I am exaggerating but only slightly)
What are the cops doing instead of doing their jobs? That's my question. Aren't they paid to go out and catch the criminals or do they simply expect to get the identity of people each day that need to be investigated?
Well put. It's pretty much impossible to sympathize with Vance saying this when the administration he is a part of is scaremongering about "the enemy within".
Governments should be scared of their people, though not in the way that I expect Vance means.
It's certainly better than the opposite, where citizens and residents are scared of their government, which wields the power to deprive them of their freedom, possessions, and life.
>Governments should be scared of their people, though not in the way that I expect Vance means.
A guillotine once in a while for some politicians/bureaucrats will do some good. There is a rich history of the French doing it. I'm not even trying to be funny.
I think the US government has made these kinds of requests too, similar tactics such as mass data collection without a warrant and so on.
I don't think it is "scared" as much as just the usual human desire to do whatever the task is ... without thinking of the consequences.
Then Vance should do something about the 5 eyes which is likely the source of this sort of thing.
[dead]
On our continent, the obvious solution to every problem under the sun is "more state".
The unspoken part of that is Vance likely thinks that the people should fear their government.
True.
It's a very unwise position Vance takes.
The world would clearly be better run if all governments feared their people, than it would if all people fear their governments.
The UK can pull this kind of stuff precisely because they do not fear any consequences from their people.
[dead]
[flagged]
2 replies →
To give you a counterpoint: from this side of the pond it is extremely surprising to see how effective Vance's speech has been in distracting a good proportion of the American public. Which, I have to suspect, was the real point.
[dead]
I am unsympathetic to those that lecture others on not doing the very thing they are doing.
You might be unaware of FATCA, then.
J.D. Vance's problem with Europe is that we have too many brown people.
As a very privacy-oriented European I don't need American alt-right populists to concern troll about surveillance and privacy in Europe.
What the fuck? They should be. They absolutely aren't right now and that's a major problem.
lol. ask JD Vance what he thinks about Assange or Snowden.
[flagged]
[flagged]
2 replies →
[flagged]
This unexpected news really cemented that point for him.
This can set a dangerous precedent. Now why wouldn’t any country demand the same, basically eliminating Advanced Data Protection everywhere, making user data easily accessible to Apple (and therefore governments)?
The choice was either eliminate it now (globally, via introduction of a backdoor) or eliminate it in the UK (but keep it globally).
So, perhaps this is a bit of a dangerous precedent, but it was the least-bad option.
That’s a false dichotomy.
Another choice, however unpalatable to all parties, would have been for Apple to stop doing business in the UK.
14 replies →
When UK demanded a backdoor to e2ee in iMessage, Apple told them they’d rather get out of UK. Why not do the same here? You’re posing a false dichotomy.
6 replies →
It isn't really a precedent. Companies, even high-rolling American tech companies, have to abide by the laws and regulations of the countries that they operate in. I guess there is a question of whether this is a legal demand that they truly had to follow, or just a request, and whether they could fight it in court, but Apple seems to be hoping to adjudicate it in the court of public opinion (apparently the initial backdoor request was secret and it got leaked).
> abide by the laws and regulations of the countries that they operate in.
In this case, the UK is seeking to use local law to change what is allowable on an international basis.
That's a bit different than a nation controlling the law on their own soil.
8 replies →
what do you mean? other countries have demanded the same, e.g. China.
China only requires it for their citizens. The UK asked access to any person's data in the world.
Wait, are you saying the U.S. might demand the same? In the current political environment?
UK is much smaller than US and they didn’t even fight this ¯\_(ツ)_/¯
What are you actually supposed to do in the UK if you oppose this sort of thing to stop laws like this coming in? It feels like the government has been incredibly out of touch for the last number of years.
You get the hell out and emigrate. I did so last year. It's not going to get better chap
Where did you go?
> It feels like the government has been incredibly out of touch for the last number of years.
Did you vote for any single one of them?
If you did, then what you're supposed to do is stop voting for Tory-lite governments (such as the current one).
If you didn't vote for any of these governments (including this one), everything else that you could do would be dangerous nowadays.
Join the ORG for starters. Contact your MP. But yes, the number of people who care is small and so things will not change until it is large.
I would guess you'd vote a libertarian party.
Probably the best on the civil liberties front are the Liberal Democrats (they were pretty good at quashing mandatory national ID cards back in the day, at least).
That being said, they still have a lot of folk angry at them for allowing university fees to be introduced 15 years ago when they were in coalition government (a Tory policy!).
[flagged]
That doesn't help. Next they'll come for the privacy phones.
5 replies →
The current EU-UK adequacy decision[1] is up for review this 27 June [2] .
Aspects of the UK investigatory powers act is close enough to US FISA [2] that I think this might have some influence, if brought up. IPA 2016 was known at the time of the original adequacy decision, but IPA was amended in 2024 . While some things might be improvements, the changes to Technical Capability Notices warrant new scrutiny.
Especially seeing this example where IPA leads to reduced security is of some concern, I should think. The fact that security can be subverted in secret might make it a bit tricky for the EU to monitor at all.
[1] https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CEL...
[2] ibid. Article 4
[3] FISA section 702 https://www.govinfo.gov/content/pkg/BILLS-110hr6304pcs/html/...
Presumably this applies to the iPhones owned by UK government ministers, civil servants, personal devices of military personnel, UK businesses, etc.
As a brit, I find that my government's stupidity is almost its only reliable attribute.
Presumably not, politicians have a way of excepting themselves in these types of laws. It's almost as if they understand the need for privacy, they just fail to apply that understanding to any scenarios beyond their own.
I meant that Apple's decision to withdraw ADP applies to them, not the Investigatory Powers Act. Or are you saying that Apple will give them a free exemption?
1 reply →
"Presumably not"
Rubbish. Give me one example? They will have to abide as well.
1 reply →
So many questions around this that need answering, such as:
1. What happens if I have ADP enabled and then visit the UK? Will photos I take there still be E2E encrypted? If not, will I be notified? I realize that at the moment the answer is yes, that for now, they are only disabling ADP enrollment. But they are planning to turn it off for everyone in the UK in the future. So what happens then?
2. If they make an exception for visitors, such as by checking the account region, then obviously anyone in the UK who cares about security will just change their account region - a small inconvenience. Maybe this will be a small enough group that the UK government doesn’t really care, but it could catch on.
3. Is this going to be retroactive? It’s one thing to disallow E2E encryption for new content going forward, where people can at least start making different decisions about what they store in the cloud. It’s an entirely different thing for them to remove the protection from existing content that was previously promised to be E2E encrypted. When they turn off ADP for people who were already enrolled, how is their existing data going to be handled?
This is bad news and it is going to be messy.
These are important questions, particularly 2 because even a layover in London or Dublin puts you under UK jurisdiction. So now you have to put that into account when traveling.
The precedent here is China. I spent a few days in China and, as far as I know, my region is still <other country> and ADP is still active.
How does a layover in Dublin put you in UK jurisdiction?
I have seen advice in big companies to only take a burner phone when going to China on business. Perhaps the same will apply to the UK.
1 reply →
This law raises serious concerns about being a non UK resident using British software, like Linux Mint.
No, it really does not.
How can you definitively know?
6 replies →
The smartphone is a terrible platform. Something like this could never happen on the PC, where you can install any encryption and backup software that you want.
While Apple did the right thing by refusing to give the UK government a backdoor, they are responsible for getting users in this situation in the first place.
I'm not familiar with the iPhone and maybe there is already an alternative to iCloud ADP, although that would make this whole situation completely nonsensical.
> Something like this could never happen on the PC, where you can install any encryption and backup software that you want.
Microsoft wants to have a word with you regarding their Windows operating system that's installed on their device that you're renting.
I'm on arch. Still, while I agree that Windows is becoming more closed, you are still free to create and distribute Windows app without asking anyone for permissions.
Veracrypt works just fine on M$ Windows 11 for FDE.
The smartphone platform is the most secure by default personal computer most people own, largely because of the control enforced by Apple.
If we are saying "secure", we should talk about what we are securing and against whom.
A smartphone may be secure against malicious individual actors but its certainly not the most secure when it comes to your private data. Modern day smartphone is designed to maximize capturing your private information like location, communication patterns, activity and (sometimes) health information and pass it on to as many private players(a.k.a apps) as possible, even to governments without your knowledge. You don't have much control over it.
In that aspect it is less secure than your typical PC. A PC doesn't have that level of private information in the first place and whatever information it has will leak only if you opt-in or get infected by malware.(recent Windows versions without necessary tweaks may be considered a malware by some).
1 reply →
But along with that also comes a massive pressure point for rogue states to take advantage of. With a diversity of services this would not be nearly as possible.
Secure for Apple, not for the users.
I haven’t checked lately but since it launched the iPhone has allowed the owner to choose whether to back up to Apple’s servers (which would be affected by the UK order) or back up to their local computer.
> or back up to their local computer.
You mean back up to their Apple computer, yes?
I certainly can't back up an iPhone to my Linux computer.
1 reply →
It's not an either-or, actually, even though the setting is worded like it is. But even if you have cloud backups enabled, you can still manually trigger a local backup.
Given that the most popular software of this kind is Dropbox I’m quite confident that nothing you’ve said is true.
My point is that if someone wants e2e encrypted backup, it is not difficult to set up on a PC even for non power-users.
The more I live I’m less concerned about what are often described as “bad actors”. The bad actors are often the state, and this kind of information is collected without thought to the risk of future politicians who don’t follow the rules or who don’t have any respect for the laws.
Through all history state security has been a thing. The Stasi and KGB are transparently state security forces to the West, but the CIA and MI5/6 are... what exactly?
The primary purpose of these agencies, despite what has been written down on paper, is NOT to protect the citizens of the countries that fund them. It is to protect the system that taxes those citizens.
States are not inherently good, they are just large organisations with a monopoly on certain social functions. All large organisations have the capacity to inflict terrible harm.
I'm going to start purging anything I store on the cloud. I'm not doing anything illegal, but why does the government want to treat me like I am.
Indeed. Time to leave the panopticon!
Why is there only one "iCloud" to backup your iPhone and store photos? Lots of ADP users would use a corporate or self-hosted solution instead.
As far as I know you can still opt to backup your entire iPhone to a local computer instead of iCloud.
You can also manually transfer photos to the computer. Or you can enable a different app (Google Photos or Dropbox for example) to store copies of every picture you take, and then turn off iCloud Photos.
Note that neither Google nor Dropbox are E2E encrypted either though.
What would you recommend as a DIY method?
I have a NAS that is accessible through VPN. But I don't trust its encryption, thought it is in my controlled location.
3 replies →
because Apple privacy is just marketing, they just want you to pay for it, they don't really care if it's possible to do better for free / by others
The reason is that Apple was never required by UK law to offer any alternative. I think the DSA intended to challenge that, but it would do nothing for UK residents.
I regret immensely not having turned ADP before... Now I'm feeling really angry at this whole thing.
The best time to turn on ADP was before this happened. For folks not in the U.K., the second best time is right now. The more people who use it, the more disruptive it will be to turn off.
Keep in mind there are some risks with any E2EE service! You’ll need to store a backup key or nominate a backup contact, and there’s a risk you could lose data. Some web-based iCloud services don’t work (there is a mode to reactivate them, with obvious security consequences.) for what it’s worth, I’ve been using it for well over a year (including one dead phone and recovery) and from my perspective it's invisible and works perfectly.
Here's how:
On iPhone or iPad
On Mac
Unfortunately, the title says
> Apple pulls data protection tool after UK government security row
4 replies →
The article reports that it will be disabled for existing users at a later date.
I'm guessing this is because they haven't figured out a way to do it yet. I'm not very well versed in how these systems work but surely this type of encryption can't be disabled by Apple remotely (or they would have that backdoor they don't want)?
6 replies →
If you care, then it's time to ditch iPhone and Android phones altogether. It's not like anything they offer will be safe. You need to invest instead in a FairPhone with e/OS or a PinePhone or some similar alternative. Something where you have complete control of the software and ideally the hardware.
The UK wanted access to anyone's data. Not just UK citizens and then additionally added regulations forbidding apple to disclose this.
UK is ~3-4% of apples income. While I appreciate Apples actions here, I wish they would make a real stand here and pull completely out of the UK.
I really wish they would sit down and negotiate this more openly. The silence from the other players is what really makes me uncomfortable. The fact that only Apple is making a stand against this ask is really scary.
Agreed, the UK is speed running 1984 right in front of us.
2 replies →
[dead]
I’m at the point where I’m ready to get a pixel and install graphene
Right but then you are jailed at Heathrow for not unlocking your phone.
The UK has made it clear that Counter Terrorism legislation has no limits in UK law even if that means compromising all systems and leaving them vulnerable to state actor attacks.
MPs will continue to use encrypted messaging systems that disappear messages during any inquiries of course.
Schiphol was already the superior airport for connections anyway, not being arrested just sweetens the deal.
You can provide a self destroy PIN with GrapheneOS.
4 replies →
Take a dumb phone (or none)?
Except no one has ever been jailed for simply refusing to unlock a phone unless there was heavy evidence there was something on the phone.
Stop spreading incorrect FUD
4 replies →
I'm in a similar position. Strongly considering replacing my iPhone with a Pixel. But I realize I'm vulnerable via cloud services. GrapheneOS won't save me from someone poking through my Dropbox. I'll have to find another option for that too.
Nextcloud works great on GrapheneOS if you are willing to self host.
Until it will be illegal to do so.
Devil's Advocate (meaning I don't agree with this, in fact I disagree with it, but I don't see this argument being made anywhere and think it would be interesting. If you're one of the people who are offended by this practice of people steel-manning "the other side" and only want to read comments that affirm your position, please don't read this comment).
Question: Wouldn't it be better for Apple to build a UK-only encryption that is backdoored but is at least better than nothing? If Apple really cared about people's privacy, why just abandon them?
My position: No because this is a war, not a battle. Creating a backdoored encryption would immediately trigger every government on the planet passing laws banning use of non-back-doored encryption, which would ultimately lead us to a much, much worse world. Refusing to do it is the right thing IMHO.
The UK's law here is specifically targetting encrypted data globally.
> The UK government's demand came through a "technical capability notice" under the Investigatory Powers Act (IPA), requiring Apple to create a backdoor that would allow British security officials to access encrypted user data globally.
Without Advanced Data Protection, your data is still encrypted at rest, it's just that Apple safeguards the encryption key. The purpose of ADP is to remove control of this key from Apple, so that it's impossible for Apple to leak your data to any third party, even if they are compelled to.
So to me, backdoor encryption seems like it defeats the whole point of ADP, no? But if not - even if there is some tiny marginal benefit - cryptography is extremely expensive to get right. It's doubtful that it makes financial sense to Apple to develop a new encryption workflow for a single country for very slight security benefits.
And it still wouldn't be complying with the UK's demands anyways. The UK demanded access to accounts worldwide. If Apple is going to be non-compliant, then they might as well be non-compliant the easy way.
What the UK government achieved:
Lowering the data protection of it's citizens in comparison to the rest of the world.
I was under the impression governments were supposed to protect their citizens.
the government's monopoly on force just means they're thugs most people tolerate...
>> Lowering the data protection of it's citizens in comparison to the rest of the world. I was under the impression governments were supposed to protect their citizens.
This depends on whether you see "citizens" as individuals or as a group. In other words it's possible that to improve the security (and thus protect) the majority, the rights of individual citizens need to be eroded.
For example, to protect vulnerable citizens from crime (the cliche of child porn is useful here, but it extends to most-all crime) it's useful for prosecutors to be able to collect evidence against guilty parties. This means that the erosion of some privacy of those parties.
Thus the govt balances "group security" with "individual privacy". It has always been so. So to return to your original hypothesis;
>> Lowering the data protection of it's citizens in comparison to the rest of the world. ... and also, making it easier to detect and prosecute criminals, and thus protect the citizens from physical harm.
Now, of course, whenever it comes to balancing one thing against another, there's no easy way to make everyone happy. We all want perfect privacy, coupled with perfect security. Some will say that they'll take more privacy, less security - others will take more security and less privacy. Where you stand on this issue of course depends on which side you lean.
More fundamentally though there's a trust issue. Citizens (currently) do not trust governments. They assume that these tools can be used to harm more than just criminals. (They're not wrong.) If you don't trust the govt to act in good faith then naturally you choose privacy over security.
You restate my hypothesis adding your own words:
"also, making it easier to detect and prosecute criminals, and thus protect the citizens from physical harm."
Did this happen though? Whilst I agree with your philosophy, in reality the UK government are no closer to lawfully accessing our data, but our data are less protected from potential other threats (e.g. unlawful access to a data centre, rogue Apple employees).
It's what actually happened as opposed to the government intention that matters to the people affected.
So my statement "Lowering the data protection of it's citizens in comparison to the rest of the world" still stands, and I'd add "whilst the UK government achieved absolutely zero in its quest to lawfully access individual's data".
If you're in the UK, please consider signing the below petition. Thanks.
https://you.38degrees.org.uk/petitions/keep-our-apple-data-e...
I never understand why people create petitions (targeted at the gov) on a non-official site.
I'm not familiar with UK law, but what's the matter? They're equally valid in jurisdictions that I know of, a signature is a signature no matter where it was put
I'd personally just trust the government variant more with my government ID data than a third party but that's up to the petitioners to weigh and decide
1 reply →
What's stopping Apple from launching an AppleTV-esque device that functions as personal iCloud storage?
The design of ADP is that even taking control of the data centre won't allow access to the information held within. Decentralising the service makes it significantly harder to write ham-fisted legislation that aims to prevent tech companies from offering secure products.
Additionally there isn't a technical need for ADP to interface with iCloud. Apple could feasibly release free software for DIY ADP.
My expectation is that either the UK will alter the law, or Apple will work around it. I don't think we're looking at the end of this.
> Apple > freely release
If Apple can't get you to pay for it, it won't happen. They only pay as much lip service to privacy as they need for marketing purposes
Commercial security is pure theatre at the end of the day. Apple could pretend to make a big stink, release a new encrypted Time Machine or leave the UK... but why? None of that makes them money. It's a band-aid for the user freedom that was amputated decades ago.
I don't expect Apple to fight this like, say, the EU regulations. Without a profit incentive, it's hard to mobilize Apple to seek a solution.
>release a new encrypted Time Machine or leave the UK... but why? None of that makes them money.
Would this device be free?
They keep asking for more and more ridiculous powers, but then someone on a terrorist watchlist will go and stab a bunch of toddlers. They don’t need more powers, they need to just do their jobs.
> Caro Robson said she believed it was "unprecedented" for a company "simply to withdraw a product rather than cooperate with a government".
She believes wrong. Google retreated from the Chinese market to not give in. Apple stayed in China and also banned VPNs on App Stores for Chinese customers. Kudos to Apple to not giving in to a backdoor in this case but some there companies took a even higher moral stand in some other situations, so there is precedent indeed.
I don't like Apple, nor do I use any of their products, but as someone from the UK, I do respect them for doing this.
Now if only the other companies who said they'd leave would grow a backbone...
Not gonna lie, I expected Apple to just kind of roll over and take the blow on this one. Interesting.
If any of the tech firms would resist, it would be Apple.
I wasn't sure which way they'd go.
While Apple especially under Tim Cook has done a lot questionable acquiescences under Cook for political expediences, they really didn’t have a choice here. It was the law.
Now going back on Twitter to get in the good graces of President Musk and bringing TikTok back to the AppStore even though it is clearly against the law is different.
15 replies →
They did. They've giving the UK Government a backdoor to all UK users.
Apple lost here.
But Apple is not giving the UK Government anything they didn't already have. Now iCloud encryption will function in the UK just as it has for years (decades?) before the inception of ADP.
Technically, they are leaving the front door open to all interested parties
They heavily compete on "privacy" and "security", so I wouldn't expect them to. Additionally, once you start rolling with one government, every one wants you to do something for them while offering you no additional money for the work and weakening of your project.
"Existing users' access will be disabled at a later date."
Hmmm how? How can they decrypt your already end-to-end encrypted and uploaded data without you entering the passphrase to do so? I can understand them removing the data from iCloud completely, or asking you to send the keys to Apple, but I don't understand how they can disable the feature for already uploaded data.
They will lock UK users out of iCloud until they manually disable ADP.
When a user turns off ADP in settings, their device uploads the encryption keys to Apple servers.
What if the users don't agree to disable ADP? So if one pays for iCloud+, they'll be refunded? And what happens to their already uploaded data? Is it deleted?
1 reply →
I am going to say something a bit controversial around here, but all of this E2E and security stuff is just lip service for marketing to consumers.
These companies have to comply with so many laws and want cozy relationships with governments, so they play both sides. It likely does things differently, but if the keys are not secure, then its not secured
Notice all the undemocratic dictatorships that did not require this of apple. The UK is in decline completely.
Apple could have disabled iCloud completely for UK users. This would protect both UK users and other users who’s data would also been captured in an iCloud backup.
They would lose some money on services, but would have been the better choice to stand up to the UK government and protect the UK users.
It's fine to continue providing the service as long as people know it's not encrypted. I am not worried about my photos being subpoenaed; I am worried about losing them. I'd rather have the service.
What exactly can UK users do now? Turn off "backup iPhone to iCloud" and stop syncing notes?
If you have ADP, Leave it on and have them automatically delete it at some point? Otherwise yes.
“Customers who are already using Advanced Data Protection, or ADP, will need to manually disable it during an unspecified grace period to keep their iCloud accounts, according to the report. Apple said it will issue additional guidance in the future to affected users and that it "does not have the ability to automatically disable it on their behalf."
UK users can still perform an encrypted backup to their local PC or Mac.
Time to leave Apple, to buy and use hardware and solutions that you really own and have control.
It's a drag that we're seeing this crap happen, but authoritarians will be authoritarians. What's the general opinion of tools like Cryptomator? [^1]
[^1]: https://cryptomator.org
I'm confused. I thought iCloud was end-to-end encrypted anyway, and I've never heard of ADP before. Is ADP encryption at rest, whereas normal iCloud storage is only encrypted from the device to the server?
The only difference is Apple doesn't hold the encryption keys when you use ADP.
In both cases it's encrypted in transit and at rest.
TIL that Apple holds the keys to my iCloud encrypted data!
3 replies →
See the "Data categories and encryption" section:
"The table below provides more detail on how iCloud protects your data when using standard data protection or Advanced Data Protection."
https://support.apple.com/en-us/102651
Why can't governments simply compel every software developer to create a backdoor, or go to jail?
If even one government does it, then the backdoors exist globally. Here is an overview of the global situation: https://community.qbix.com/t/the-global-war-on-end-to-end-en...
Does this mean I should treat travel to the UK the same way as China and only bring a burner device with no information on it or on cloud backup accounts?
Border control agents in all countries -- including the US -- have fairly extensive powers to search your devices or deny you entry. I'm not sure this decision should change your calculus on that point.
See also https://medium.com/@thegrugq/stop-fabricating-travel-securit...
Company trade secrets probably shouldn't be on the device? Edit - or the device's cloud backups?
Could moves like this by other repressive regimes finally open the door to consumer-owned, consumer-controlled, decentralized cloud storage systems that are fully encrypted and inaccessible by any agency or individual except by the owner?
Would be a beautiful thing to see. Not sure how storage would work though since you cannot take payment (that would make it centralized), and storage would have to be distributed, but by who?
> inaccessible by any agency or individual except by the owner?
I believe the UK already has "you must unlock anything we ask" as part of the RIP/2000[0].
[0] https://en.wikipedia.org/wiki/Regulation_of_Investigatory_Po...
> "Apple saw this as a point of principle - if they were going to concede this to the UK then every other government around the world would want this."
How is withdrawing the full encryption capability from UK users not condeding to the UK government?
They are not the first country to do this. Apples advanced security features are rolled out non-uniformly across global markets. You get different capabilities, depending on where you are and where your account is resident, it would be great if there was a website that listed the countries and the security protections Apple provides in those countries.
How will they enforce this?
They will have to send out messages 'You have 32465 hours before you account is deleted unless you decrypt'
This is NOT a good look.
Wonder what the cost/benefit looks like from Apple's perspective.
If this requirement increases the proportion of data on Apple's servers that is now unencrypted (or encrypted but which can be trivially unencrypted), that could be a huge plus to Apple; more data to use for ad targeting (or to sell to third parties), and more data to train AI models on.
The UK backdoor means US and other FVEY states are able to freely request any person’s private data from GCHQ.
This provides an incentive for Apple computer users to do the right thing: Stop storing sensitive data on Apple servers. Unfortunately, due to Apple's pre-installed proprietary operating systems that phone home incessantly, that may be more challenging than it should be.
Related discussion:
U.K. orders Apple to let it spy on users’ encrypted accounts (washingtonpost.com) 762 points by Despegar 14 days ago | 1070 comments https://news.ycombinator.com/item?id=42970412
Can someone explain what's changed in the UK that they would consider requesting unfettered access to all Apple customer data (including outside their own borders)? I get that the NSA is infamous for warrant-less surveillance, but this seems a step further.
It is "just" the domestic intelligence agency ordering Apple to backdoor their own system be able to supply data for lawful interception. As I read the article, it's not a UK backdoor in the sense they can roam around in every users data. The domestic agencies still need to follow the rules of lawful interception, namely they need a warrant, and it is targeted at UK nationals only. At least that is how I read the article.
This isn't warrant-less, it's with a warrant. This isn't really a change the UK, it's the UK trying to adapt to the proliferation of E2E encryption - ten years ago, law enforcement could always access your messages, now the default if you're on whatsapp/iMessage is they can't because E2E is on by default. UK lawmakers aren't happy with a default position of the state being totally incapable of reading messages, no matter what the law says.
It might not be cryptographically sensible, but it is responding to a real change in the strength of the state.
Labour Party was elected six months ago. It is doubling down on existing government surveillance policy as a cure-all weapon to investigate and chill opposition, and to humble foreign tech companies.
Nothing's changed, they just want the same access to people's data they've always had. They loved completely unencrypted text messages.
The rise of first-party end-to-end encryption has made life difficult for the security services so they just want to get rid of it.
Also historically the US government loved the UK doing all this spying because the US wasn't allowed to do a lot of it on their own citizens.
This is part and parcel of the collapse of western capitalism (aka American empire). You get two main choices when capitalism fails - fascism or communism/socialism. It's clear that the UK has chosen fascism (either liberals like Labor or extreme right like Reform).
That choice exists only in cases in which the people can effect a revolution. The UK elite is too strongly in control of the country through its establishment, so, it will be a loud tumble down the hillside towards fascism...
Uncontrolled immigration and terrorist threat, but also probably they want to look at people's nudes. Jolly lot.
If you care about privacy and security of your data, you aren’t using public services from Apple or Google, or “big tech” anyways.
I always thought of “cloud” services to be a sham. I only trust them with transient data or junk data anyways (glorified temp storage, at best).
concessions afer concessions we gave away our freedom. the axis of good is mostly responsible for this but the opposition also wanted to remove anonymity and freedom from the web.
no one fought when the democrats called snowden or assange russian spys for revealing clinton corruption. they just blindly sided with their own corrupt political party and gave away freedom. just like previous govs censored trump, banned political opponents they created a precedent and opened the door to the end of freedom. its now beyond politics, we should fight for the last moments of freedom we have before its too late.
...you go first. I'll applaud, and call everyone else over, if anything interesting happens.
So instead of building a back door they're just completely removing the option to use E2E encryption altogether, thus making everything freely available to government by default?
How is that not worse or at least equivalent to a back door?
>How is that not worse or at least equivalent to a back door?
It's bad for the citizens of the UK and better for everyone else on the planet with an iPhone. UK citizens should be angry with their government, not Apple.
They’re just pulling the feature in the UK. If they put in a back door, they’re pulling the feature for everyone.
Much better than a false sense of security. Customers know what they get, and can choose other products instead of being confused or cheated.
It _is_ equivalent to a back door, that's the point. The UK demand can be accessed more rapidly and properly by disabling the feature than by implementing a backdoor, since it is the same thing.
Many departments use iphones. I wonder how it will affect government security or government employees will be exempt?
The UK requested the backdoor for all users, not just UK citizens.
No illusion of privacy.
What happens if a British citizen/resident buys an iPhone in the USA?
Btw, as a European citizen, I always buy my devices in the USA. We can complain about the US as much as we want, but Europe is on another level.
I think the iCloud services is based on the region of your Apple Account. So you could theoretically use a US region Apple Account and enjoy iCloud services. But that means you won't get UK region apps, except in the app store you can switch to different Apple Accounts as you please, so you can have multiple accounts for different regions (which is what I do).
As an EU citizen, the US* (govts) can stay way from my stuff. I won't even vpn through the
*or any other gubments.
Of course, when the rubber truncheon comes out, I'd be happy to show my encrypted stuff. But until then, or without a warrant, I'd prefer not to.
I always thought that metadata and circumstantial evidence is enough to incriminate someone. Do you really need plaintext data and communication to put criminals behind bars?
Could this be the catalyst for the rise of third party encryption companies that operate in UK? Or perhaps, rise to third party self host E2E cloud solution?
Only time will tell.
I've already invested in USB storage :)
Ugh. Is this by App Store country? Anyone know what happens if I already have it configured? I’m actually in US App Store region and sometimes switch to UK… I wonder if that would disable it.
If anyone’s looking for open-source, self-hostable, E2EE storage then checkout Peergos (disclaimer: lead here):
https://peergos.org
Deep betrayal by Apple.
"privacy is a fundamental human right" - Tim Cook.
I don't get what's happening to civil liberty in Europe.
We can drink alcohol in outdoor public places, can Americans?
The problem is the decline. We had more liberties 10 years ago than we do today.
Whether Americans are free or unfree shouldn’t distract us from this.
This is specific to each municipality/state. The United States federally has no laws regarding the outdoor consumption of alcohol.
Yes.
The empire is collapsing, so the chairs are being moved aside, the curtain behind the stage is being drawn and the ugly brick wall is being exposed...
This was Brexits doing. As we are no longer EU, we have our own cool rules such as the upcoming PM allowed to watch me take a piss law.
The EU is currently planning exactly the same thing with Chat Control.
3 replies →
> This was Brexits doing.
Not really? We've had horrors like the 2000 RIP[0] well before Brexit. The Blair government made a huge dent in civil liberties and the Tories carried it on.
[0] https://en.wikipedia.org/wiki/Regulation_of_Investigatory_Po...
7 replies →
Pot, meet kettle!
Frankly, our democracies are currently in a rather precarious state.
At least we don't get to pee in the cup at work
[flagged]
Troll much?
Your comment history reeks of differentiated, sensible arguments...
Overall quite ironic as in plain sight to anyone reading the news in the last two years, almost all of Western Europe sees rising right wing and extreme right wing parties.
1 reply →
Nothing is happening to it. Governmental overreach, and then if people really want encryption they will vote in privacy-friendly officials. Here in Oregon, USA, we have Ron Wyden, who knows more about netsec than most IT graduates.
As long as you can vote there is still civil liberty, just vote for the right people who care about this stuff.
None of what you just said translates to any European country.
None.
Executive power is very representative, not direct, with the sole exception imo being Switzerland?
It's just a shame that Apple didn't include the contact details for the Home Office officials responsible as the place for inquires regarding the matter.
At some point, we need to stop being surprised at authoritarian countries doing authoritarian things.
Here's hoping the inevitable regime change will be a peaceful one.
What is stopping me from using something like Proton in the same way? Why does the UK government simply make an example out of Apple on this one?
Ok, I am not very technical. Can someone help me understand this. I don't have Advanced data Protection on. Does that mean UK Gov can see my data now?
It means Apple has the encryption keys to your backed-up data. So they can, in theory, access it, if the UK Gov demands that they do. That might never happen to you, but with ADP it would have been impossible, because even Apple can't access it.
See https://support.apple.com/en-us/102651
Potentially. It really just means your data is stored unencrypted, so anybody that has access to Apple's servers can access your data. I don't believe any government has open access to Apple's servers, but they can get a warrant.
I just realized ADP is not same as Lockdown mode. which Apple mentioned that only people that are likely to be targets need to turn on.
Now I don't see any reason why I shouldn't turn ADP on. Turning on now.
They always could. With advanced data protection they could not. The law mandated to add a backdoor to allow the government to also see encrypted data (which made the encryption insecure by definition). Apple refused to comply so you don’t even have the option to encrypt your backups now.
Reading all the comments here makes me sick. I really need to move to a remote place where people are not constantly bashing each other.
Are there non-icloud backup options? There used to be local encrypted backups through itunes, but I can't tell if that feature is still around.
Still exists but now backup is integrated into Finder. You can also do encrypted backup on Windows but I forgot what the app is called (from Apple).
ITunes but it is a PITA. Do a test backup restore too. It may not restore if the phone was nearly full (maybe 80%) when backed up.
What happens if you're an international traveller?
This will likely depend on your primary account region. Apple can't just turn off E2EE on existing account nilly willy.
<< Apple can't just turn off E2EE on existing account nilly willy.
If they are able to, then then can be compelled. Do you mean won't/wouldn't?
4 replies →
Does Apple offer this type of encryption in China?
Could this have been a reason UK pushed to separation from the EU?
EU is all for privacy while UK is slowly drifting towards becoming a Stasi state.
No, EU is NOT "all for privacy". I don't know where this myth comes from but I see it repeated here often.
1. EU is pushing for mandatory on-device scanning of all your messages (chat control). The current proposal includes scanning of all videos and images all the time for all citizens. The proposal started with analyzing all text too. The discussions are happening behind close doors. EU Ombudsman has accused EU commission of "maladministration", no response.
2. EU is allowing US companies to scan your emails and messages (ePrivacy Derogation). Extended for 2025.
3. EU is pushing for expansion of data retention and to undermine encryption security (EU GoingDark).
"The plan includes the reintroduction and expansion of the retention of citizens’ communications data as well as specific proposals to undermine the secure encryption of data on all connected devices, ranging from cars to smartphones, as well as data processed by service providers and data in transit." https://www.patrick-breyer.de/en/eugoingdark-surveillance-pl...
4. EU is pushing for mandatory age verification to use email, messengers and web applications. Citizens will be required to use EU approved verification providers. All accounts will be linked back to your real identity.
5. "Anonymity is not a fundamental right": experts disagree with Europol chief's request for encryption back door (January 22, 2025)
https://www.techradar.com/computing/cyber-security/anonymity...
-----
Do you still believe EU is all for privacy? EU's privacy is deteriorating faster than in any other developed country / bloc. Some of these proposals have been blocked by Germany for now but that is expected to change after the upcoming elections.
< EU is pushing for mandatory on-device scanning of all your messages (chat control)
Again and again, 'Eu' is not pushing anything like that. A few Euparl MPs backed by those like Ashton Kutcher did.
> Eu isnt 'planning' anything like that. Some Euparl MPs backed by people like Ashton Kutcher tried to push a law to spy on all chat apps. Then when the dirty web of American-style regulatory manipulation was exposed, they backed off. It was a proposal for a law by some MPs. Not something 'Eu' did.
3 replies →
This is blatantly false.
The EU has been pushing to pass the Chat Control law for the last 3 years which is even worse because at least in the UK the government would still need to get a warrant for the data they want whereas the EU wants to analyze your chat messages, emails and pictures in real time without cause or need to justify themselves.
> Again and again, 'Eu' is not pushing anything like that. A few Euparl MPs backed by those like Ashton Kutcher did.
2 replies →
The Chat Control law was voted down and it would not apply for UK if they'd still be in EU.
2 replies →
How do you like your "liberal democracy", UK-ians? Is that democratic enough for you yet? Do you feel in control?
Is there a way for a UK iPhone to circumvent the warning and enable ADP? Like connecting through a VPN?
Being locked into an ecosystem seems really nice.
The problem is that you don't really know your future jailer.
The cloud is just someone else’s computer. If you really, really care about privacy, self host.
That works for nerds like us. But my sister or my non tech friends don't have knowledge to self host. It is like asking a person to do a surgery on themselves when they don't have medical knowledge. E2E services are very crucial for such normal people.
How long do you think for governments to make it illegal to self host or backdoor Linux builds? They have already went too far by just asking backdoor to data of every single person on the planet. We should oppose such unethical laws rather than finding workarounds.
> How long do you think for governments to make it illegal to self host or backdoor Linux builds?
Probably never, it won't be worth the trouble because it's always going to be a fringe thing for the reasons you say :). One can hope anyways.
Also, if the government decides I'm a baddie, they can always just show probable cause to a judge and come physically get my hardware, so they have a more traditional path there to handle weirdos like me already :).
FWIW, I agree completely strong encryption in SAAS is necessary for privacy. But pragmatically, there's little hope laws like this won't eventually take root in more places. So the statement stands irregardless of the challenges: the cloud is just someone else's computer.
One final note: I don't think E2E means what most people think it means unfortunately - lots of companies imply that you're the only one with access to the encryption keys when E2E is on, but if you read the fine print, it often really just says is the data is encrypted in flight, not what the policy is for protecting the data on the other "end."
This is the awesome thing about ADP - they spell out the full policy in glorious detail.
For those to whom that sounds scary: buy a regular consumer NAS. They run quite a few applications nowadays (besides being file storage as a base feature) and are meant to be setuppable by an average person
This is almost the status quo in the USA, given that nobody turns on the optional e2ee anyway.
I live between France and the UK. How do I move my iCloud account out of Britain?
Not relevant to the Apple story but as a general comment on UK surveillance/search/detainment laws: Five Eyes means the US just needs to get their citizen into the UK for their partner to gain access that the US doesn't have to their citizen. The reciprocity possibilities are endless.
Really disappointed that our government decided to take such a stance.
What are people using when self-hosting services in the scope of iCloud nowadays? Nextcloud seems the closest comparable service.
If you own an iPhone then nothing can come close to the feature set of iCloud. Apple just have it on lockdown and dont expose the functionality that would be needed for a competitor to take advantage of this.
A great time for all people to jump to android IMO and experience the freedom of choice it gives you.
As a British citizen I am amazed at how much the government has invaded our privacy. I think it started after 9/11 when they first introduced terrorism laws and saw they could get away with it. I wonder if the ruling classes are nervous, given the state and direction of our economy and the inequality, as well as the iron grip a small part of the country has maintained on society. They are perhaps making preparations for a class revolt.
Having said that, in practice to date the extraordinary powers the government has acquired are rarely used, eg to quell the race riots last year. It feels more like a risk for the future and that makes it harder to argue against now. One day this will hit the fan.
I’m very curious, however, to see Americans criticise our government for its (mostly theoretical) overreach, whilst simultaneously the constitution of America is being torn to shreds by the actions of Musk and Trump, with some in the tech community even cheering on DOGE.
Hm. I see them as connected - "we must confront our problems domestically before we fight them abroad."
Please could you expand? I'm very confused by what's going on in the states, particular the attitude in the tech community, so any clarity would be appreciated!
2 replies →
Removed all my stuff from iCloud about a month ago in preparation for this.
How does this affect me if I travel to the UK with an E2E encrypted IThing?
not at all
They should of forced ADP on by default and this would of never happened.
The problem with that is that if the user loses their key, their account is no longer recoverable. As things are with ADP, enabling it comes with a bunch of warnings about that, and IIRC it also forces you to print out the recovery key for safe storage.
That would alienate users due to key management complexity. Apple is about having a smooth user experience.
Apple processes multiple orders of magnitude more account recoveries for customers each day than receive government requests.
Hopefully it'll spur growth of decentralised, distributed peer to peer mobiles like the new Holochain-based Volla Phone https://volla.online/en/
Write to local MP and Home Office. This is totally unacceptable.
ok so while being AI safety concerned.. uk politicians go ahead and remove humanity's single logical control tool that they have to keep AI in check.. encryption maths.
gg
Honestly I'm surprised that rather than trying to build stupid backdoors and such, tyrannical governments don't just try to make a encryption key database. They hold ALL the keys and can get into anything they want, anytime they want. If you get caught with keys or encrypted data they can't access, punishment ensues.
Like if you're gonna try to eliminate privacy and freedom, just be honest and open about your intentions.
I wonder, what are the alternatives now?
Tresorit? Self-hosted Nextcloud?
There is no alternative really as only iCloud can back-up your settings, saved networks, and apps data.
Other apps like Nextcloud, can only backup documents (those not in apps) and pictures, because there's an API for this.
iTunes backup is an option, but it's not automatic and convenient.
Is that true? Only iCloud can back up an iPhone? They dont provide any way to even extract an encrypted archive so you can keep it safe for yourself?
I get more and more amazed at Apples lock in tactics. This is why I own nothing Apple, and have complete control over everything in my digital world.
5 replies →
It encrypts your entire phone backups as well
It’s really not that complicated and none of those options can serve as an adequate backup for iOS devices including app data and meta data.
Just back up your phone to your computer via iTunes (Windows) or the built in facility on Macs
Very disappointed with this, but I think will be finding alternatives.
Family sharing especially of Reminders is a hard one - we use lists for grocery shopping and it is extremely convenient.
Has anyone tried out Ente https://ente.io/ for photos?
The beginning of the end. A sad day for Brits
Well this is double plus ungood...
Are anyone of you lot getting the realisation onto why they are pushing Passkeys so hard?
They know they access 8 out of 10 phones they seize.
DONT USE PASSKEYS
This is a good reminder that the one who cares about privacy and security cannot rely on closed-source products from commercial companies; don't be deceived by marketing slogans.
If Apple was a real American Company they would solve this issue by withdrawing their devices from the UK.
Is Palantir a Real American Company?
This is a great article!
Could any hackers on here now please hack the fuck out of UK government ministers please?
I doubt it would play out like you think.
As someone currently a citizen of the UK, what are my best emigration opportunities?
Ireland might be easy option.
UK citizens do not need a visa or residency permit to live and work in Ireland due to the Common Travel Area (CTA) agreement
You do realise that the UK government is, and always has been, notorious for surveillance. They haven't changed since before WW2 and probably never will, even if Apple suddenly decides to play hardball with them.
And to be very, very honest, if you look across the Five Eyes nations, I don't think this is much different from what other countries deal with when it comes to access to data. You had PRISM, the trick of asking other countries for access to their own citizens data to avoid scrutiny, and Apple delaying the implementation of E2E in the US after federal agencies got pissed about it. The list goes on for a long time. At least in the UK, the government is so detached from commoners hurt feelings that they ask for what they want explicitly, with no fear of political consequences.
The fact that it's always sucked is precisely why I want to leave.
If you value personal freedoms, you should go to East Europe. The more to the east, the better. Snowden went to Russia.
> Snowden went to Russia.
He was stuck in an airport when his passport got cancelled. It's not really a free choice if you can't go anywhere else, and planes suspected of carrying you get forced to land, even if by virtue of being denied airspace access until they run out of fuel.
https://en.wikipedia.org/wiki/Evo_Morales_grounding_incident
freedom to _what_? Corruption is high, media is pretty restricted under Orban, and it doesn't look all that great for freely expressing your identity either. Whether Poland will follow their direction or manage to turn around is still up in the air.
You're only more "free" there if you have the money to bribe officials.
https://en.wikipedia.org/wiki/SORM
https://en.wikipedia.org/wiki/Roskomnadzor
Snowden didn’t go to Russia because of the government there “valuing personal freedoms,” he went there bevause it is one of the very few major countries that absolutely will not cooperate with any extradition requests from western countries.
If you are thinking of going to east europe (and especially Russia) in search of personal freedoms, I got a bridge to sell you (for context, I grew up in Russia). The only “freedom” some of those countries might provide is the freedom from the long reach of the hands of western governments (and even that is a “maybe”, as Andrew Tate has been discovering recently).
Kremlin has full access to every service operating in Russia. If a service is banned in Russia, that's a service you should use. If it's not banned, it already has a backdoor.
Dublin?
Depends on what you’re after * Australia * United States * Singapore * Dubai * Europe (Belgium/Switzerland/Netherlands)
If you're after freedom, you absolutely do not want Singapore or Dubai.
7 replies →
Australia is even more everyone-is-a-cop than the UK, and is doing this exact same shit for the exact same reason.
Of the whole list, if the Investigatory Powers Act is what you didn't like, I'd pick Switzerland first, then Belgium/Netherlands.
Of course, that assumes you're fluent in the local languages. Hoe goed spreekt u Nederlands?
I made a jump to Germany in 2018, and, thanks to learning a new language, have had a front-row seat to how flat the real Dunning Kruger effect really is: https://en.wikipedia.org/wiki/File:Dunning–Kruger_Effect2.sv...
Dubai, even as an international hub where you may be able to get by with English — لا تضيع وقتك باستخدام دولينجو لتعلم اللغة العربية، لقد حاولت خلال الوباء وما زلت لا أعرف الأبجدية — is much more authoritarian than the UK. Similar for Singapore.
If you're monolingual, and privacy is your concern, then the US is an improvement over Australia.
But also consider Canada and Ireland.
Ireland isn't in Five Eyes, Canada is, but also Canada is slightly further away from the madness of Trump etc. than any company still inside the USA.
I'm not even sure what's going to happen with the US federal government given that DOGE cannot meet its stated goals even by deleting all discretionary-budget federal agencies like the NSA, CIA, FBI, all branches of the armed forces, etc. but on the other hand the private sector is busy doing a huge volume of spying anyway in the name of selling adverts… chaos is impossible to predict, and you should want to predict things at least a few years out if you're going to the trouble of relocating.
2 replies →
If you abhor surveillance, don't pick a Five-Eyes nation.
Don't forget the 14-Eyes, which includes most of Western Europe.
Wasn't this in line with JD Vance's European Eulogy last week, that we shouldn't be using 1984 as a playbook?
1984 could only ever have been written by an Englishman
we need something that's quantum safe
How many UK people who haven't heard of ADP will now enable it?
Absolutely mental the kind of people that have power. Dealing with this like immature children.
“We don’t get what we want? We ruin it for everyone.”
Trying to backdoor a privacy feature for no real reason, just for the sake of having a backdoor. Pathetic
disables apple cloud sync
Let's vote Labor and Liberal to keep the UK from going fascist on our data.
Oh wait....shit.
This was done under the Investigatory Powers Act which was brought in in 2016. Saying that Labour weren't exactly against it at the time. Point being snooping isn't left or right - they all love it.
Labour are not anti authoritarian. Often quite pro
They got what they voted for and now that those voters are surprised?
It's really hilarious to try to blame previous governments for such unpopular moves like this one.
If Labour was any better, then they would never have used the Investigatory Powers Act to force Apple to take actions such as this.
For those who thought Labour would never do this, should just admit that this move was done under Labour and they are no better than the Tories.
The party most likely to cut this stuff out is Reform, although they'd probably be closer to ambivalent about it.
UKIP/Brexit/Reform as a vehicle to hold large influence over politics from outside Westminster might.
I would imagine the party's attitudes on a myriad of things would shift if they were in power though.
I’m pretty sure Reform would scrap this stuff, given the belief their part of politics has been a victim of these laws.
Also worth considering Lib Dem if you’re not into right wing politics- they did vote against the relevant investigatory powers act back in 2016.
The Blairite wing of that party has always been extremely bad with this kind of thing (see Tony Blair's obsession with ID cards over the decades) so it's unsurprising they'd push something like this.
This was predictable vs creating a backdoor
its a shame
I'm drunk. No offense. Why our world ends up like this.
Well, it usually starts with one...socially, like.
Lol so much for the privacy-first Apple BS everyone keeps touting
If they had any balls whatsoever they would've rejected this and pulled out of the UK, but of course money comes before anything else.
yikes
It's the right choice: don't bow to government pressure, let the people pressure the government.
This is Apple condeeding. Apple lost. UK Government got (almost) what they wanted - a backdoor into iCloud accounts.
Apple's only consolation prize is that its limited to UK users for now. But it seems inevitable that ADP will gradually be made illegal all around the world.
Given that they’ve only prevented new signups it looks to me more like Apple is trying to apply pressure to the U.K. government to get them to back down. The law that permits this was passed in 2016 so the situation was default lost already.
1 reply →
> let the people pressure the government.
Hopefully they will.
There was a lot of campaigning against the Investigatory Powers bill when it was introduced. It didn't help much given the people in power want more power regardless of where they sit on the political spectrum.
I can't imagine many here (UK) will really care, we've had multiple breeches of privacy imposed on us by the powers that be. - Removed incorrect assumption of this not being reported.
7 replies →
How?
In the UK, there's no right to bear arms, so people are pretty helpless against their oppressing government.
>> In the UK, there's no right to bear arms, so people are pretty helpless against their oppressing government.
There's a right to bear arms in the US and it doesn't seem to be helping them with their oppressive government.
8 replies →
I'm sure shooting at the government would have solved this privacy issue.
6 replies →
I just dont interact with the government or British society at all. I have turned my back on it.
If they ever come to my door I'll either go postal or leave the country.
Its so bad here now.
1 reply →
> In the UK, there's no right to bear arms, so people are pretty helpless against their oppressing government.
When people want to revolt it doesn’t seem like the right to bear arms has much to do with it. Not having the right to bear arms certainly hasn’t stopped countless rebellions and revolutions across the world. It’s not like the French of the Russians had a right to bear arms before their successful revolutions.
Even in the UK, the lack of a right to bear arms didn’t stop Cromwell using firearms to defeat Charles II at the Battle of Worcester.
Technically I guess you're right, but one hopes that the foundations of British democracy provide its citizens with the tools to fight against an oppressive government. The only rub is getting them to stand up and do that.
1 reply →
Because that’s working so well for the US
9 replies →
Small arms are no match for drones and a fully armed military, a successful rebellion by any populace against a first world military is impossible unless the military lays their arms down voluntarily, full stop.
12 replies →
Weird. In the US there is a right to bear arms, yet people are also pretty helpless against their oppressing government.
3 replies →
We could try the American way, bear our arms and shoot up a school, but I don't see how that will help.
Guns are an inefficient/stupid way to kill people anyway.
Just ask Russia and Ukraine.
Look around, human beings are quite clever.
NO, it's the wrong choice. Most people do not understand this stuff enough to truly care about, and they just want their devices to work. This is an awful decision by Apple. There's really nothing consumers can do to pressure the British government.
Consumers being unable to pressure government, even if true, does not imply this is a bad decision.
1 reply →
Those people aren’t enabling ADP to begin with.
3 replies →
It's the right decision. Don't bow to the government, let the people demand it from their leaders, and vote in new ones.
Yes, countries lacking in proportional representation and having obscure procedures like proroguing parliament are the best at listening to important but fairly obscure issues from their voters. </s>
[dead]
[dead]
[dead]
[flagged]
[flagged]
[flagged]
Yikes... looks like Apple sun is setting. This cannot be allowed to happen.
It's not just an Apple thing. It's not even just a UK thing.
malicious compliance.
Providing access when ordered by a court is not as secure so we're removing all encryption?
"If we can't provide this product legally, we're not going to provide it at all" ends up being the only reasonable position in situations like this.
At least this way doesn't compromise users in other countries.
>Providing access when ordered by a court is not as secure so we're removing all encryption?
Providing a back door for one government reduces the security and privacy of the service worldwide.
This decision keeps the security and privacy for the rest of the world. Sucks for the UK that your politicians decided to go this route.
End-to-end-encryption-except-when-the-UK-government-is-interested doesn't have the same ring to it, liable to damage the brand ....
FWIW people always put too much trust in E2EE where they didn't control either end. This was a loooong time coming.
3 replies →
the whole point of ADP is that they cannot provide access
Yes, the parent commenter missed the part where Apple cannot see the encrypted content when ADP is used.
10 replies →
Wow - how sad. To think the 2nd highest scoring post ever on hacker news is Apple's 2016 A Message to Our Customers. A display of intelligence, morality and courage under great pressure: https://hn.algolia.com
How things have changed.
> In a statement Apple said it was "gravely disappointed"
So are we, Apple. So are we.
Apple did the right thing.
I would much rather they were transparent, so that people can move services, rather than build a backdoor in secret, to appease the far-left Labour government.
Oh stop with "far left" nonsense, none of our main political parties are much further than slightly left or right of centrist.
1 reply →
Building a backdoor and telling us is better than building a backdoor and not telling us, but not building a backdoor at all is ideal.
Workers in tech jobs over the past few decades are the ones who are primarily to blame for the total degradation of the very notion of privacy, and our societies are, I think, reaping the consequences of this now in many ways.
This story didn't spring up out of nowhere, like a monster from under the bed. It's been a gradual decline since, let's say, the 90s or so.
I don't want to be vulgar, but the people who understood the best what was happening were mostly too busy taking large paychecks to get too upset about the whole thing. It got explained away, rationalised, joked about, and here we are.
Easier to push away the blame for a foot soldier, claiming to do things on orders or claiming to be absolutely f clueless where it leads, one is worse than the other. Thousands had to make this work and function as it is.
Still, this is a different topic than the government use of law enforcement for preserving the shity situation that was built by the industry and its actors just when the trend becomes of fixing what was made to be crap, just when people want to correct the f up of the ignorant collaborants.