Apple has reportedly been ordered by the UK government to allow it access to encrypted data stored by the company’s users worldwide in its cloud service.
At the moment, only the Apple account holder can access such data – not even the US technology giant can see it.
Apple, which makes iPhones, iPads and iMacs, has been issued with a Technical Capability Notice (TCN), the Washington Post and BBC are reporting.
This order, which does not get published, is said to require a blanket ability for the government to view people’s encrypted data – both in the UK and abroad.
The Home Office will not confirm or deny the existence of the order. Apple has been approached for comment.
Getting technology companies to break encryption has long been a contentious issue in the UK government.
Ministers have argued they want to use it for purposes like protecting children, identifying criminals and keeping the public safe.
What are the concerns?
Opponents say it is a breach of privacy. They also highlight the risk to whistleblowers and journalists, and point out that any tool the government has to break into people’s information has a danger of being hijacked by bad actors.
There are also concerns that, if implemented, the UK’s order could lead nations like China to force Western companies to break their users’ privacy.
‘Advanced Data Protection’
On Apple products, users have the option to use Advanced Data Protection (ADP).
The UK government’s demand applies to all content stored using ADP, which means certain data can only be decrypted by the user.
Apple promises that even a cloud data breach would not make the information readable.
Users are also told that Apple cannot see the data due to the end-to-end encryption used to share the information.
End-to-end encryption means that messages and data sent between two devices can only be read by the person they are sent to – and are scrambled if anyone else tries to intercept or access them.
The debate stretches as far back as 2017, when then home secretary Amber Rudd stated that “I don’t need to understand how encryption works” to want it broken.
The order from the UK government was made under the UK Investigatory Powers Act 2016, according to The Washington Post. The act says the orders can be applied to companies outside the UK.
There are avenues for Apple to appeal against the TCN, but this process would not be made public.
The Labour government has been outspoken in its desire to target social media and technology companies while in power.
This includes recently trumpeting its plans to be the first country in the world to create a new AI sexual abuse offence to punish those generating and facilitating the creation of AI child sexual abuse images.
And Home Secretary Yvette Cooper has criticised social media companies for not being fast enough to take down videos previously viewed by Southport killer Axel Rudakubana.
Last year, Apple provided written evidence to MPs on its many oppositions to the Investigatory Powers Act and TCNs.
It noted that the law gives the UK government the power to “act as the world’s regulator” of security technology – something which could put it at odds with authorities like the European Union and the United States.
Order would ‘undermine human rights’
The American company also said that an order to force decryption would “undermine fundamentally human rights” and potentially put the UK at odds with the European Court of Human Rights.
“There is no reason why the [UK government] should have the authority to decide for citizens of the world whether they can avail themselves of the proven security benefits that flow from end-to-end encryption,” Apple said.
It added: “Moreover, any attempt by the [secretary of state] to use its extraterritorial powers to compel technology companies to weaken encryption technology will only strengthen the hands of malicious actors who seek to steal and exploit personal data for nefarious purposes.”
