The UK is still trying to backdoor encryption for Apple users
eff.org
eff.org
Who asked for it? Let them speak up, and explain why they are so special that governments should and do obey them. Starmer doesn't personally care about any of this (or anything.) No Labour MP cares about any of this. Who is convincing them to override democracy to create tools that make it easier to override democracy? Force them to drop the pretense that they have come up with this themselves, and that they personally believe that it is important.
Start by finding out who the hands were who wrote the actual text. The MPs themselves, and the network of important nephews and nieces that work on their respective staffs are too stupid to write this stuff. Who are the minds that are crafting law for supposed democracies from whole cloth?
The really odd thing is that you have people who will claim that the media is run by right-wing billionaires. On certain topics, you will see every story come from civil servants, the government is just too big (the easiest way to tell is the sources, articles run by civil servants will almost never have actual sources and will usually not be constructed in a logical way, for example a new one is to repeatedly refer to Russia). But because so many people are making so much money from the government, this kind of thing is ignored (and I will also say, the observation that this isn't the actual government just civil servants is important...some newspapers are now notorious for having civil servants contacts who brief journalists against their own ministers, Home Office is the most well-known but it has happened in almost every area...there is nothing that elected officials can do).
"Security services" isn't a power center, they are a tool used by power centers. We are not being attacked by nameless institutions, we are being attacked by people who have names.
I have absolutely no idea what theory of power people are operating under who believe that "civil servants" are trying to take over the world. Even if they're all secret Satanists working for the devil to impose evil upon the planet, let the devil introduce himself.
> The really odd thing is that you have people who will claim that the media is run by right-wing billionaires.
It is so odd to think that power is wielded by the powerful. No, it's actually powerless administrators on 80K/year who force heads of state to make bizarre power grabs. And I have no idea why right-wing billionaires get pointed out as absurd, and "left-wing" billionaires get off scot-free by going completely unmentioned. Unless you think that it's a contradiction for a left-winger to be a billionaire, then that's fair enough. A lot of them get called left-wing because they believe in global warming and vaccination or something (I don't remember Marx or the Jacobins writing about that, or trans people, or illegal immigrants.)
> But because so many people are making so much money from the government
That's the billionaires. You realize that there are people making money, and you realize that they're the ones that must be driving things, but you don't identify them and indemnify the most powerful people on the planet. I simply can't see this as a thought process at all. I have no idea how people are convinced to focus all of their anger on people with no power who they don't know.
No, they /are/ a power center. They have a lot of power: they advise governments, police and business, who listen to their advice and act on it very often. A lot of the work they do is (sadly) essential in the world as it exists today. Of course the "security services" want to open and read your mail and will advise accordingly.
I didn't say anything about taking over the world. These people are doing interviews (Ken McCallum has done several interviews, he is appearing on podcasts which is part of their new media strategy - https://www.bbc.com/news/articles/c4g2nwlpw1yo - this is an example, do you not know any journalists? How do you think a story like this gets written? Lol) and they are extremely explicit about this. The UK has a problem with terrorism, they believe that by breaking encryption they will be able to catch more terrorists. Again, they are doing interviews with the media telling you this, you don't have to have a complex world view that relies on shadowy cabals...they are telling you they are doing this, they are incentivized to do this, they are the only people with the power to do this.
It isn't a bizarre power grab, these people have legal powers, they are using these powers. Why do you think a billionaire is powerful? What legal powers does he have to break encryption? Can he arrest you? Is the history of the 20th century an example of governments overusing their powers or billionaires? Illogical.
If billionaires were making money from the government, you would see growth. The UK isn't growing. They aren't driving things because nothing that is happening is helping business. The assumption that you are making is that they secretly control everything...but what is happening now that is benefitting them? The size of the state is growing rapidly, they have effective lobbying power...because they run the government...this isn't a conspiracy theory, this is just logic. The people who have power...are the people with power. In the UK, if you actually understand how government works which you appear not to, elected officials have clearly limited powers over the departments they control. We had an election, and you are seeing the government cycle through the exact same policies that have been suggested by civil servants (which ministers are legally unable to dismiss). Is this the billionaires again? Lol.
This blanket refusal to actually look at what is happening rather than drop this world view that is embedded into personality is why the UK is collapsing. Who do you think is running the government other than the government?
I know civil servants at every level, I know MPs, why do you assume that everyone is as ignorant as you? I worked in politics. No-one who works in politics and is aware of how government works disputes this. Senior civil servants do not dispute it is happening, I believe the last three Civil Service heads have said this is happening. The narrative of "the billionaires" is something that no-one believes, it only exists to fool credulous children, I would go so far as to say (in my experience) unions do not actually believe this anymore...I am not sure who actually believes it apart from people unaware of how government works. However, there are two issues: reform is very hard because any government needs civil servants to do things (as an example, the creation of Border Force was an attempt to reform a part of the government that was out of control, it happened then Home Office civil servants spent years attempting to bring it down and limit their power, which is delegated to a substantial degree), and the Civil Service has been very successful in appearing to do enough (for example, they present a policy choice, that policy choice is ineffective by design but it sounds like something that can be sold...almost all Treasury policies are like this, they cannot work, at some level i assume ministers know they cannot work but there is something to announce, it usually is designed to sound good...I am not sure why this isn't obvious either, we have years now of governments announcing policies with no impact, you aren't slightly suspicious about why? Credulous).
Australia has close legislation with the Technical Assistance and Access bills that can be used by Law Enforcement / Australian Intelligence Community, but it explicitly doesn't allow the deliberate weakening of security or backdoors, unless such a weakness is inherent in the technology.
Authoritarians generally and right-wing populists in particular are the major proponents of government surveillance and control.
That doesn't sound super profitable. Apple made money by the truckload bending over to accommodate surveillance in China.
If Apple did not stay in the Chinese market they will very quickly have a competitor appear in that market that will then threaten other markets. Arguably, there are already Apple competitors in it and Apple's position keeps them from occupying a space that quickly leads to competing with Apple globally.
China is generally viewed as a unique market and capitulating to the Chinese government may lead to capitulation to the US, but not to any other nation as they are incomparable.
The UK market will neither create an Apple competitor nor will it provide enough scope to allow existing competitors to meaningfully grow.
Capitulating to the UK government will lead to many other countries requiring similar capitulations.
Out of the 197 countries in the world, how many have governments that respect the privacy rights of their citizens enough to prevent mass surveillance of them? Answer: Zero. Bring on the arguments about the various laws that prevent this, and I'll point you to the "national security and law enforcement exceptions" they they all have, sometimes in the form of "classified" contracts or court orders, and sometimes in the form of "executive orders" or other similar instruments. There are also agreements between the intelligence services of allied countries that facilitate information sharing, so each counterpart can do the collection and analysis of the partner nation and share the results, without technically violating any of their laws.
> The Dragonfly search engine was reportedly designed to link users' phone numbers to their search queries and censor websites such as Wikipedia and those that publish information about freedom of speech, human rights, democracy, religion, and other issues considered sensitive by the Chinese government. It is not designed to notify searchers when the information they want has been censored.
AOSP at least lets users disable a nosy baseband firmware and uninstall Play Services spyware. Apple customers are fish in a barrel if your rogue government orders an OTA update that compromises your security. Would be pretty nightmarish if you lived in a country like the United States where both companies have already been coerced into shipping backdoors: https://arstechnica.com/tech-policy/2023/12/apple-admits-to-...
Nope.
Apple is subject to the same restriction that every other company in China is.
Or Google in the US, for that matter.
If you store customer data on your server, when the government shows up with a warrant, you have no choice but to hand a copy over.
Handing over a copy of push notifications stored on your server isn't a "backdoor". It's how the law works in the United States when any agency shows up with a warrant.
That's what makes Google's business model of spying on customers as much as possible and hording customer data on their servers so dangerous.
If your state prosecutes women seeking an abortion, for instance, Google handing over data showing you were in an abortion clinic in response to a warrant is harmful.
Contrast with Apple, which operates it's own map service without keeping a log of everywhere you've been on their servers.
Police had arrested the wrong man based on location data obtained from Google and the fact that a white Honda was spotted at the crime scene. The case against Molina quickly fell apart, and he was released from jail six days later. Prosecutors never pursued charges against Molina, yet the highly publicized arrest cost him his job, his car, and his reputation.
https://www.phoenixnewtimes.com/news/google-geofence-locatio...
Google spying on people as much as possible and storing everything they glean on their servers (where they have no choice but to hand it over to any government agency with a warrant) is dangerous.
They complied with the previous request, and stopped because the US government pressured the UK government because they didn't want US nationals to also fall victim to reduced security.
I'd love to see Apple stand up this time, but given their history I don't think it'll happen beyond a miffed comment on a blog somewhere.
I also hope our idiotic government starts to go deal with the country’s _actual_ problems sometime soon instead of coming up with pointless / dangerous bs ideas like this + digital ID
At the end of the day, the emperor is happy to yank on the leash of the special relationship so long you pay him off.
Nope.
They refused to comply, and then publicly announced that they would strip encryption features from UK users before they would add an encryption backdoor.
A threat they later made good on.
There are only two defences, the law - which is on the governments side or not giving your data to people who fuel their yacht and their jet with customer data.
Either your country is a democracy where people get to choose what their government does (aka, a majority of people want these invasive policies), or it's illegitimate and should be treated as such.
Even with the most advanced statistical methods we now have no idea who would win if an election were to be held tomorrow. Even though we know the % support for each party, the way that it translates to seats is chaotic. Each of the 649 seats is a 3, 4 or 5 way race.
When we had major 3 parties (most of the 20th century) election results could at least be predicted by basic statistical methods, even if they weren't very fair they were at least predictable. Now the results are neither fair nor predictable.
As the smaller parties started to gain ground into the 21st century the polling companies developed increasingly sophisticated and expensive methods such as MRP polling to try to keep up. That worked in the 2024 election but it won't work next time.
Random selection (sortition) could be considered a viable form of democracy if the selection of members is uniform. However the precise way that random selection of members occurs now is that one party can end up with a huge number of seats regardless of their proportion of the vote. That form of random selection isn't democracy.
The US government has previously tried to force Apple to insert a backdoor into its iPhones.
Apple did fight it in court.
https://www.wikipedia.org/wiki/Apple%E2%80%93FBI_encryption_...
The answer is don’t store your data on iCloud. Self host everywhere you can, and protest. Don’t wait for or rely on a corporation to fight your battles against your government for you.
Apple fought Comey and the Biden administration on this issue back in 2015, and is still fighting in the UK.
What about US citizens living in the UK? Would they have standing to sue Apple in a US court for breach of contract?
I’m also not clear on how Advanced Data Protection could be turned off without affirmative user consent – by definition, won’t the user need to provide their secret key to decrypt their existing data? Or will the iPhone have a multi-hour update where it decrypts its entire iCloud archive on the client-side, and then reuploads it without encryption?
More likely that the phone just sends the keys to Apple in that case
If you got sensitive data, learn to encrypt it yourself. That is the ONLY way to make sure. If you trust another company to do the encryption at rest for you, that is your own fault.
edit: s/passport/password, damn my phone.
Why wouldn’t they be subject to UK laws like any other person living in the UK?
>> I’m also not clear on how Advanced Data Protection could be turned off without affirmative user consent
If I remember right from when this was initially discussed there isn’t any way to do it without incurring data loss (because the users device has a key Apple can’t access). As someone using ADP the risk of this led me to manually disable it at the time.
Yes, anyone in the UK is subject to UK law. But there is no UK law criminalizing the choice of a UK resident to enable Advanced Data Protection (or, if it’s already enabled, to not disable it).
They’re threatening Apple, not its users. Sure, Apple is subject to UK law (although it’s debatable if they’re even violating it). But they’re not immune to lawsuits in the US just because another country told them to violate their implicit contract with users.
> As someone using ADP the risk of this led me to manually disable it at the time.
That’s precisely the opposite of what you should have done. I was (and am still) using ADP in the UK. If I disabled it then I would no longer have the option to enable it. Nothing is forcing me to disable it – where is the threat of data loss? It’s only a risk if I don’t disable it, which I can do at any time in the future. You surrendered your only form of leverage for no reason and made yourself less safe in the process.
> UK users will be given a period of time to disable the feature themselves to keep using their iCloud account.
Doesn't this mean that you will be unable to use your iCloud account in the future if you have ADP enabled ?
And disabling your iCloud Account doesn’t mean that they would stop you from disabling ADP. It would probably be a red icon in settings that says “iCloud sync is paused, disable Advanced Data Protection to resume.”
(But I’m not sure I’m even subject to this, which is why I asked my original question… what’s a “UK user?” I have the US App Store active right now. I can switch to the UK store but that cancels all subscriptions, presumably including Apple Care+, which I could not re-purchase without buying a new device.)
The user can choose to download, delete from the server, and upload it again unencrypted, if they want.
> For users in the UK who have already enabled Advanced Data Protection, Apple will soon provide additional guidance. Apple cannot disable ADP automatically for these users. Instead, UK users will be given a period of time to disable the feature themselves to keep using their iCloud account.
> They notified users that they would lose access to their encrypted data in the future
There is an implicit threat of data loss here but it’s far from clear.
> According to Apple’s Xcode console logs reviewed by BBC News, existing ADP subscribers will lose access through phased certificate revocation in Q2 2025.
https://cybersecuritynews.com/apple-discontinued-adp-feature...
The UK publicly backed down before that happened.
We'll always be powerless to stop top-down attacks like this until we demand real audits and accountability in the devices we own. Shaming the UK only kicks the can down the road and further highlights the danger of trusting a black box to remain secure.
I agree political action here is totally fruitless. The UK government and Apple could already be cooperating and you would have no way of telling the difference.
Ideally, everything that runs outside of an app sandbox would be 100% Open Source. Anything short of that is not sufficient to give people full confidence against a backdoor. (Even that also relies on people paying attention, but it at least gives the possibility that people outside of a company whistleblower could catch and flag a backdoor.)
and you need to be able to compile each and every part of it.
If only specific individuals are targeted, I agree. But if it's pushed to all users, wouldn't we expect a researcher to notice? Maybe not immediately, so damage will be done in the meantime, but sooner than later.
Think of the security a games console has - every download arrives encrypted, all storage encrypted, RAM encrypted, and security hardware in the CPU that makes sure everything is signed by the corporation before decrypting anything. To prevent cheating and piracy.
Modern smartphones are the same way.
We can't expect independent researchers to notice a backdoor when they can't access the code or the network traffic.
People have been warning of this outcome for years and years. Stallman was right and all that. We got laughed out of the room and called paranoid weirdos.
Ever since smartphones were a thing it’s been obvious that this is where we were heading.
Giving away Apple's encrypted cloud is just another small step into making 1984 a reality.
In France, they tried to make a law to force signals, WhatsApp, and other encrypted messaging to implement backdoors so that they could catch drug dealers.
Thankfully, it wasn't voted for, but truthfully, the average people didn't give a shit. I wish there was a way to make people learn how important privacy is to freedom and, therefore, to democracy.
I blame the education system that teaches almost nothing relevant. We even had 'citizen lessons', but it was about learning how the political institution works. We never spoke about what is freedom, what it involves, how easy it is to lose it, how hard it is to gain it.
The big step was "Apple's cloud", i.e., people storing their data on someone else's computer^1 where the someone else is also collecting the data of millions of other people, too
1. Some HN commenters and others define "the cloud" as "someone else's computer"
Well before Apple, the recommendation was to store a backup offsite – almost nobody did. Now many do.
In response to a warrant, a bank opens that box. In response to a warrant, clouds open that box. That part of the threat model isn't new.
Another threat is forgetting the key to your safety deposit box. Most people would be angry if Apple, or their bank, wouldn't let them back in the box. Apple used to be able to help.
Now, unlike the bank, they offer a mode where only you have the key.
It's hard to say this is a step to 1984, given that up to this point, the safety deposit box threat models were similar, just Apple's digital vault was much more likely to be have the user's latest valuables when the user needed them recovered, and when they diverge it is in user privacy favor.
What this Chat Control? It's not dead, France is still in favour of implementing it if it can get a bit more support from other EU states.
Similar to France too right?:
> The French Court of Cassation has ruled that people who are suspected or accused of a crime are obliged to reveal the passcode of their mobile phone to the investigative authorities. The Court found that a mobile phone passcode can be considered a “secret decryption agreement of a means of cryptology” (convention de déchiffrement d’un moyen de cryptologie). Refusing to hand over the passcode of a mobile phone is punishable by a fine of up to 270,000 EUR or three years’ imprisonment
https://www.fairtrials.org/articles/news/french-court-rules-...
- better economies
- better policing
- better social protections (shocking!)
- more access to education
- programs that reintegrate offenders
These are, of course, much harder for a politician to work on.
>No, people are not routinely forced to give their phone passwords to English police; police generally cannot compel disclosure without a court-ordered Section 49 RIPA notice, which must be based on reasonable grounds and proportionality.
https://en.wikipedia.org/wiki/Key_disclosure_law#United_King...
Going to be a very different place in 10 years.
This is already the status quo in the US. The fact that ADP is offered as an option is irrelevant.
Lots of things to fault apple about. This likely is not one of them.
These load-bearing assumptions are part of Apple's issue.
Anyone can write a whitepaper, keeping a transparent SBOM is a different level of commitment.
ADP hasn't been available in the UK for some time now.
And there are plenty of UK users of ADP - those who got in before it was banned still have it.
From the article:
> After the U.K. government first issued the TCN in January, Apple was forced to either create a backdoor or block its Advanced Data Protection feature
> the US claimed the U.K. withdrew the demand, but Apple did not re-enable Advanced Data Protection
> The new order provides insight into why: the U.K. was just rewriting it to only apply to British users
> The Financial Times reports that the U.K. is once again demanding that Apple create a backdoor into its encrypted backup services.
If you read further, or click the FT link, you'll see the UK is now demanding access to encrypted iPhone backups.
ADP is not relevant beyond the history; the UK is not doing anything with ADP but I understand the confusion if you don't know that "iPhone iCloud backup" is a separate service for iPhones.
This isn't the type of question I normally ask people, so it sounds like you've made a bad guess here and are treating your own assumption as fact. You are incorrect; I have ADP turned on.
> Apple provides the data to the Five Eyes without a warrant.
Source? Or are you assuming here, too?
> The fact that ADP is offered as an option is irrelevant.
Only if you think no one uses it.
followed by
> almost certainly
with zero links. Sure, I'll take your word for it.
No, it’s a feature tucked away in Settings where small, small percentages of users are going to use it.
It’s great that it exists, but let’s listen to life experience. You don’t need to retort “Source! Source!” for things like this. Be our guest, ask everyone in your life and keep a tally.
There may, in fact, be dozens of us.
No one is claiming most people use it. You are claiming no one or essentially no one uses it, which is untrue.
> but let’s listen to life experience
Your life experience is apparently that you don't use ADP, so therefore no one uses ADP. This is not a useful data point.
> You don’t need to retort “Source! Source!”
So... you don't have a source?
> Be our guest, ask everyone in your life and keep a tally.
As I stated in my first response to you, it isn't a question most people ask so I'm not sure why you'd think a few comments later my take on this would change.
So anyone that has a Windows machine that has iCloud sync to their machine can’t use it.
ADP adoption: https://daringfireball.net/linked/2023/12/05/icloud-advanced...
That’s hardly true, analyzing binaries is not significantly more difficult without access to the source code. Even if you did have the source code, any serious analysis would focus on the binaries as seemingly innocuous code can be transformed into something else by a compiler.
If we’re talking about some deep hardware level backdoors, you presumably don’t have your own fab and therefore are stuck with trusting whoever you get hardware from.
The UK seems to now want Apple to decrypt/provide access to encrypted iPhone backups. This is where your device backs itself up in a restorable format to the cloud, including passwords and private data. Since Apple has a way to decrypt non-ADP iCloud data, UK wants it.
Apple already (can and do) provide any and all data they hold, including decrypting data they hold the decryption keys for in response to a court order worldwide.
A physical key sitting in a lock? Anyone walking by can turn it. Done. That's not what's happening with iCloud data.
Apple's decryption key isn't sitting there for the turning. It's stored in access-controlled systems and requires deliberate action and legal process to use. An employee or passerby can't just stroll by and "turn the key."
If you want the only copy of the key to your digital safety deposit box where you store all your stuff, thankfully there is Advanced Data Protection.
> As far as a court order is concerned
All service providers you use will provide data in response to lawful requests.
If you do not have ADP enabled (which is the case in the UK as of now), device (iPhone) backups are not end to end encrypted and are stored on Apple's systems unencrypted (or encrypted with a key that Apple knows).
If you have ADP enabled then device backups are end to end encrypted; only you have the keys and therefore only you can decrypt the backup.
20 years ago this would have been daily outrage on Slashdot's YRO section but I get the feeling no one cares enough anymore.
That's far too simply put
The UK has incredible wealth, it is just more concentrated than ever in a few select pockets
For physical infrastructure, there are certainly less well maintained areas and historical policies causing issues, but I'm not aware of any areas that are structurally/physically unsafe.
There are 'rougher' areas, places where theft is more likely but very, very few areas that are genuinely unsafe to walk through. The only ones I'm really aware of are two very small areas in London (basically 2-3 buildings) and certain kinds of traveller camps.
For pretty much everything else, it seems to be on par with other European nations - generally behind the Nordics of course.
Share the videos - I'd love to understand where you are coming from.
Everyone knows it, but you're not allowed to say it, and you're definitely not allowed to say it in the UK or you will literally be arrested for speech.
It also wasn't "centuries". The British Crown ruled India (which at the time contained Pakistan and Bangladesh) for less than a century, for instance.