UK demands access to Apple users' encrypted data

The British government has requested the ability to access encrypted data stored by Apple users in its cloud services worldwide. Currently, only Apple account holders can access this stored data, and even Apple itself cannot view it. This request was made by the UK Home Office under the Investigatory Powers Act (IPA), which compels companies to provide information to law enforcement agencies. This act grants broad surveillance powers to the government, raising concerns about privacy and potential abuse.

Apple has declined to comment on the matter, but its website states that the company considers privacy a "fundamental human right." Under the law, this request is not to be made public. The news was initially reported by The Washington Post, and the BBC also communicated with similar sources. The Home Office stated: "We do not comment on operational matters, including confirming or denying the existence of any such notices." This lack of transparency further fuels concerns about government overreach.

Privacy International has called it an "unprecedented attack" on personal privacy data. The charity's legal director, Caroline Wilson Palow, stated: "This is a fight the UK shouldn't be picking. Such overreach sets an extremely damaging precedent and will embolden abusive regimes around the world." This highlights the potential global implications of the UK's actions and the risk of other countries adopting similar measures.

This request applies to all content stored using Apple's so-called "Advanced Data Protection" (ADP). This technology uses end-to-end encryption, meaning only the account holder can access the stored data, not even Apple itself. It is an optional service, and not all users choose to activate it. This is because, while it makes your data more secure, it also has a drawback: it highly encrypts your data, making it unrecoverable if you lose access to your account. The trade-off between security and accessibility is a key consideration for users.

It is currently unclear how many people have chosen to use ADP. Importantly, the government's notice does not mean authorities will suddenly start combing through everyone's data. It is believed that the government wants to access this data if there is a national security risk; in other words, it will target individuals, not use it for mass surveillance. Authorities must still follow legal procedures, have sufficient grounds, and request permission to access specific accounts to access the data, just as they do now for unencrypted data. This provides some safeguards against indiscriminate access.

Apple has previously stated that it would rather withdraw encrypted services like ADP from the UK market than comply with such government requests, telling Parliament that it would "never build a backdoor into its products." Cybersecurity experts agree that once such an entry point is created, it is only a matter of time before bad actors discover it. Even withdrawing products in the UK may not be enough to ensure compliance; the Investigatory Powers Act applies to any tech company with a presence in the UK market, even if they are not based in the UK. This underscores the far-reaching implications of the legislation.

So far, no Western government has successfully attempted to force major tech companies like Apple to break their encryption. The US government has previously made this request, but Apple explicitly refused. In 2016, Apple refused a court order requiring it to write software that would allow US officials to access a gunman's iPhone, although the matter was resolved after the FBI successfully accessed the device. In the same year, the US dropped a similar case after being able to gain access by discovering the person's password. Similar cases have occurred since, including in 2020, when Apple refused to unlock the iPhone of a man who carried out a mass shooting at a US Air Force base. The FBI later stated that it had been able to "gain access" to the phones. These instances highlight the ongoing tension between law enforcement and tech companies regarding encryption.

Under the legislation, the tech giant can appeal the government's request, but even if ultimately overturned, it cannot delay implementing the ruling during the legal process. The government argues that encryption makes it easier for criminals to hide, and the US FBI has also criticized the ADP tool. Professor Alan Woodward, a cybersecurity expert at the University of Surrey, said he was "appalled" by the news, and privacy activists "Big Brother Watch" called the reports "disturbing." This highlights the strong opposition to the government's actions from various sectors.

The organization said in a statement: "This misguided attempt to solve crime and terrorism will not make the UK safer but will erode the fundamental rights and civil liberties of the entire population." The UK children's charity NSPCC has previously described encryption as the front line of child abuse, as it allows abusers to share hidden content. But Apple says its customers' privacy is at the heart of all its products and services. In 2024, the company objected to proposed amendments to the Investigatory Powers Act, calling them "unprecedented overreach" by the government. These amendments also included giving the government the power to veto new security measures before they are implemented. These amendments have passed into law. This demonstrates Apple's continued commitment to privacy despite government pressure.

Lisa Forte, a cybersecurity expert at Red Goat, said: "The main problem with exercising these powers is that it is unlikely to produce the results they want. Criminals and terrorists will simply move to other platforms and technologies to avoid being convicted. Therefore, it is ordinary law-abiding citizens who suffer the loss of privacy." This underscores the potential unintended consequences of the government's actions and the importance of considering alternative approaches to combating crime and terrorism.