Apple Pulls iCloud Advanced Data Protection From UK
Apple is taking the unprecedented step of removing its highest level data security tool from customers in the UK, after the government demanded access to user data.
Advanced Data Protection (ADP) means only account holders can view items such as photos or documents they have stored online through a process known as end-to-end encryption.
[…]
Apple would not comment on the notice and the Home Office refused to either confirm or deny its existence[…]
[…]
It is not clear that Apple’s actions will fully address those concerns, as the IPA order applies worldwide and ADP will continue to operate in other countries.
More insidiously and outrageously, they are apparently forbidden by UK law, under severe penalty (imprisonment), from even informing the public about this demand, or, if they were to comply, from telling the public what they’ve done.
[…]
Re-read Apple’s statement above, which I’ve quoted in full, including the hyperlink. What stands out is that Apple is offering no explanation, not even a hint, why the company “can no longer offer Advanced Data Protection (ADP) in the United Kingdom to new users and current UK users will eventually need to disable this security feature”. On issues pertaining to security and privacy, Apple always explains its policies and features as best it can. The fact that Apple has offered no hint as to why they’re doing this is a canary statement of sorts: they’re making clear as best they can that they’re under a legal gag order that prevents them from even acknowledging that they’re under a legal gag order, by not telling us why they’re no longer able to offer ADP in the UK.
It is crazy that Apple would seemingly rather close down the company than let people install apps from outside the App Store, even running an extended PR campaign against it, but they roll over immediately for this.
Even if they didn’t want to risk acknowledging the notice—which I was hoping they would—you’d think Apple could say something in general about the law and the process. On the other hand, I guess Apple is so far doing more than other companies that presumably also received the notice. Are they silently building in backdoors?
Note that the loss of Advanced Data Protection in the UK does not affect the existing end-to-end encryption of several other Apple features available in the country, including iMessage, FaceTime, password management and health data.
As of February 21, users in the country can no longer enable the feature; those users who currently have it on will have to disable it in the near future.
[…]
According to Apple, this change won’t affect data that is end-to-end encrypted by default, such as health data and iCloud Keychain. That does, however, leave one longstanding loophole: though Apple’s Messages in the Cloud system is end-to-end encrypted, the encryption key for those messages is backed up in iCloud Backups, for which Apple holds the keys. Those are, in turn, accessible to law enforcement under the proper procedures.
Previously:
